Database
WordPress vulnerabilities listed in CISA KEV (page 1355)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SQL Injection | CVE-2014-3937 | — | |
| Critical9.8 | SQL Injection | CVE-2014-10017 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-10016 | — | |
| Critical9.8 | Arbitrary File Read/Deletion | CVE-2014-1907 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-1905 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-1908 | — | |
| Critical9.8 | SQL Injection | CVE-2014-100022 | — | |
| Medium5.3 | CAPTCHA Bypass | CVE-2014-2265 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100023 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-2297 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-2315 | — | |
| Critical9.8 | 3.9.4 - SQL Injection | CVE-2014-1854 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-10381 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2014-2274 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-8800 | — | |
| Critical9.1 | SQL Injection | CVE-2014-2316 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-1906 | — | |
| Medium6.5 | Authorization Bypass | CVE-2014-1889 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-2040 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100016 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-125090 | — | |
| Medium6.1 | Open Redirect | CVE-2014-1750 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2012-6629 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-100026 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4563 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-1232 | — | |
| High7.5 | Directory Traversal | CVE-2013-7240 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-6992 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6991 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7276 | — |
- Critical9.8SQL Injection
Contextual Related Posts
<1.8.10.2Update to 1.8.10.2
- Critical9.8SQL Injection
Welcart e-Commerce
≤2.9.1Update to 2.9.2
- Medium6.1Cross-Site Scripting
Welcart e-Commerce
≤2.11.1Update to 2.11.2
- Critical9.8Arbitrary File Read/Deletion
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Critical9.8Arbitrary File Upload
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.27.4Update to 4.29.5
- Medium5.3Full Path Disclosure
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Critical9.8SQL Injection
mTouch Quiz
<3.0.7Update to 3.0.7
- Medium5.3CAPTCHA Bypass
Contact Form 7
<3.7.2Update to 3.7.2
- Medium6.1Cross-Site Scripting
mTouch Quiz
<3.0.7Update to 3.0.7
- Medium6.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.29.6Update to 4.29.9
- Medium6.1Cross-Site Scripting
Thank You Counter Button
≤1.9.3No patch available
- Critical9.83.9.4 - SQL Injection
AdRotate Banner Manager
3.9 – 3.9.4Update to 3.9.5
- High8.8Cross-Site Request Forgery
User Domain Whitelist
<1.5Update to 1.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Subscribe To Comments Reloaded
≤140129Update to 140219
- High7.1Cross-Site Scripting
Nextend Social Login and Register
<1.5.1Update to 1.5.1
- Critical9.1SQL Injection
Search Everything
<7.0.3Update to 7.0.3
- High7.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Medium6.5Authorization Bypass
BuddyPress
<1.9.2Update to 1.9.2
- Medium6.4Stored Cross-Site Scripting
Media File Renamer: Rename Images & Files for SEO (AI-Powered)
<1.9.4Update to 1.9.4
- Medium6.1Cross-Site Scripting
Photocrati
≤4.8.0Update to 4.8.1
- Medium6.1Reflected Cross-Site Scripting
Media Downloader
≤0.1.992Update to 0.1.993
- Medium6.1Open Redirect
Nokia Maps & Places
<1.6.7Update to 1.6.7
- High8.8Cross-Site Request Forgery
Newsletter Manager
<1.4Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
April's Super Functions Pack
≤1.4.7Update to 1.4.8
- Medium6.1Cross-Site Scripting
URL Cloak & Encrypt
<3.8.0Update to 3.8.0
- Medium6.1Cross-Site Scripting
Foliopress WYSIWYG
<2.6.8.5Update to 2.6.8.5
- High7.5Directory Traversal
Advanced Dewplayer
≤1.2Update to 1.3
- High8.8Cross-Site Request Forgery
AskApache Firefox Adsense
≤3.0No patch available
- Medium6.1Cross-Site Scripting
WP-Cron Dashboard
<1.1.6Update to 1.1.6
- Medium6.1Cross-Site Scripting
Recommend to a friend
≤2.2.2No patch available