Database
WordPress vulnerabilities listed in CISA KEV (page 1354)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.5 | Stored Cross-Site Scripting | CVE-2014-3123 | — | |
| High7.5 | 3.9.001 - Missing Authorization | CVE-2014-3849 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3841 | — | |
| Medium5.3 | Missing Authorization | CVE-2014-3844 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4537 | — | |
| High7.5 | Missing Authorization and Sensitive Data Exposure | CVE-2014-3848 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4584 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4525 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4530 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4529 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4531 | — | |
| High8.8 | 3.9.001 - Cross-Site Request Forgery | CVE-2014-8948 | — | |
| High7.2 | Remote Code Execution | CVE-2014-2558 | — | |
| High7.2 | 3.9.001 - Remote Code Execution | CVE-2014-8949 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-125093 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-100001 | — | |
| Medium5.5 | Stored Cross-Site Scripting | CVE-2014-2995 | — | |
| High7.1 | Reflected Cross-Site Scripting | CVE-2014-100018 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-2333 | — | |
| Critical9.6 | Multiple Cross-Site Request Forgery | CVE-2014-2579 | — | |
| Medium4.3 | Contributor Users Can Publish Posts | CVE-2014-0165 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2014-2559 | — | |
| Medium6.5 | Authentication Cookie Forgery | CVE-2014-0166 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10902 | — | |
| Medium5.4 | Cross-Site Request Forgery | CVE-2014-2340 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100008 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-100009 | — | |
| Critical9.8 | Local File Inclusion | CVE-2014-2674 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-2838 | — | |
| High7.2 | Blind SQL Injection | CVE-2014-2839 | — |
- Medium5.5Stored Cross-Site Scripting
NextCellent Gallery – NextGEN Legacy
<1.9.18Update to 1.9.18
- High7.53.9.001 - Missing Authorization
iMember360is
3.8.012 – <3.9.001Update to 3.9.001
- Medium6.1Cross-Site Scripting
Contact Bank – Contact Form Builder for WordPress
≤2.0.19Update to 2.0.20
- Medium5.3Missing Authorization
TinyMCE Color Picker
≤1.1Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
Keyword Strategy Internal Links
≤2.0No patch available
- High7.5Missing Authorization and Sensitive Data Exposure
iMember360is
<3.9.001Update to 3.9.001
- Medium6.1Cross-Site Scripting
wp-easybooking
≤1.0.3No patch available
- Medium6.1Cross-Site Scripting
WP eBay Product Feeds
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
flog
≤0.1No patch available
- Medium6.1Cross-Site Scripting
flash-photo-gallery
≤0.7No patch available
- High7.1Cross-Site Scripting
Game tabs
≤0.4.0No patch available
- High8.83.9.001 - Cross-Site Request Forgery
iMember360is
3.8.012 – <3.9.001Update to 3.9.001
- High7.2Remote Code Execution
File Gallery
<1.7.9.2Update to 1.7.9.2
- High7.23.9.001 - Remote Code Execution
iMember360is
3.8.012 – 3.9.001Update to 3.9.002
- Medium5.3Full Path Disclosure
Ad Blocking Detector
≤1.2.1Update to 1.2.2
- High8.8Cross-Site Request Forgery
SEO Plugin LiveOptim
≤1.1.3Update to 1.1.4
- Medium5.5Stored Cross-Site Scripting
Twitget
≤3.3.2Update to 3.3.3
- High7.1Reflected Cross-Site Scripting
Unconfirmed
<1.2.5Update to 1.2.5
- Medium6.4Stored Cross-Site Scripting
Lazyest Gallery
<1.1.21Update to 1.1.21
- Critical9.6Multiple Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<3.1.1Update to 3.1.1
- Medium4.3Contributor Users Can Publish Posts
WordPress
≤3.8.1Update to 3.7.2 or 3.8.2
- Medium6.3Cross-Site Request Forgery
Twitget
<3.3.3Update to 3.3.3
- Medium6.5Authentication Cookie Forgery
WordPress
≤3.8.1Update to 3.7.2 or 3.8.2
- High8.8Cross-Site Request Forgery
WP Customer Reviews
<3.0.9Update to 3.0.9
- Medium5.4Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<3.1.1Update to 3.1.1
- Medium6.1Cross-Site Scripting
JS Multi Hotel
≤2.2.1No patch available
- Medium5.3Full Path Disclosure
JS Multi Hotel
≤2.2.1No patch available
- Critical9.8Local File Inclusion
Ajax Pagination (twitter Style)
≤1.1No patch available
- High8.8Cross-Site Request Forgery
GD Star Rating
≤1.9.22No patch available
- High7.2Blind SQL Injection
GD Star Rating
≤1.9.22No patch available