Database
WordPress vulnerabilities listed in CISA KEV (page 1356)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2013-7279 | — | |
| High8.8 | Cross-Site Request Forgery to Denial of Service | CVE-2013-7233 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6993 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-7319 | — | |
| Critical9.8 | SQL Injection | CVE-2013-7187 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7129 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-7419 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-7102 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-20002 | — | |
| Critical9.1 | Authentication Bypass | CVE-2013-4462 | — | |
| High7.1 | Cross-Site Request Forgery and to Cross-Site Scripting | CVE-2013-6797 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6281 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2701 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5978 | — | |
| Critical9.8 | SQL Injection | CVE-2013-6243 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-10027 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3263 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-3264 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3491 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5916 | — | |
| Critical9.8 | SQL Injection | CVE-2013-5917 | — | |
| High7.2 | Cross-Site Scripting | CVE-2013-6010 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-5962 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-5963 | — | |
| Medium6.3 | Spoof Post Authorship | CVE-2013-4340 | — | |
| Medium6.4 | .swf and .exe File Upload | CVE-2013-5739 | — | |
| High8.8 | Deserialization | CVE-2013-4338 | — | |
| Medium5.4 | Open Redirect | CVE-2013-4339 | — | |
| Medium6.4 | HTML File Upload | CVE-2013-5738 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5711 | — |
- Medium6.1Cross-Site Scripting
S3 Video Plugin
≤0.982Update to 0.983
- High8.8Cross-Site Request Forgery to Denial of Service
WordPress
≤2.0.11Update to 2.1
- Medium6.1Cross-Site Scripting
ad-minister
≤0.6No patch available
- High7.2Stored Cross-Site Scripting
Download Manager
≤2.5.8Update to 2.5.9
- Critical9.8SQL Injection
FormCraft
≤1.3.7Update to 1.3.8
- Medium6.1Cross-Site Scripting
Bloog
≤1.1Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
JS Multi Hotel
≤2.2.1No patch available
- Critical9.8Arbitrary File Upload
OptimizePress
<1.6Update to 1.6
- Critical9.8Arbitrary File Upload
Elemin
<1.4.3Update to 1.4.3
- Critical9.1Authentication Bypass
Portable phpMyAdmin
≤1.5.0No patch available
- High7.1Cross-Site Request Forgery and to Cross-Site Scripting
Blue Wrench Video Widget
≤1.0.5Update to 2.0.0
- Medium6.1Cross-Site Scripting
dhtmlxspreadsheet
≤2.0No patch available
- High8.8Cross-Site Request Forgery
Social Sharing Toolkit
≤2.1.1Update to 2.1.2
- Medium6.1Cross-Site Scripting
Cart66 Lite :: WordPress Ecommerce
<1.5.1.15Update to 1.5.1.15
- Critical9.8SQL Injection
WordPress Landing Pages
<1.2.3Update to 1.2.3
- Medium4.3Cross-Site Request Forgery
Blogger Importer
≤0.5Update to 0.6
- Medium6.1Cross-Site Scripting
WP Ultimate Email Marketer
≤1.2.0No patch available
- Critical9.8Authentication Bypass
WP Ultimate Email Marketer
≤1.2.0No patch available
- Medium6.1Cross-Site Scripting
Sharebar
≤1.4.2Update to 1.4.3
- Medium6.1Cross-Site Scripting
Bradesco Gateway
≤2.0No patch available
- Critical9.8SQL Injection
NOSpamPTI
≤2.1No patch available
- High7.2Cross-Site Scripting
Comment Attachment
≤1.5.5No patch available
- Critical9.8Arbitrary File Upload
Complete Gallery Manager for WordPress | Galleries
<3.3.4Update to 3.3.4
- Critical9.8Arbitrary File Upload
Simple Dropbox Upload
<1.8.8.1Update to 1.8.8.1
- Medium6.3Spoof Post Authorship
WordPress
≤3.6Update to 3.6.1
- Medium6.4.swf and .exe File Upload
WordPress
<3.6.1Update to 3.6.1
- High8.8Deserialization
WordPress
≤3.6Update to 3.6.1
- Medium5.4Open Redirect
WordPress
≤3.6Update to 3.6.1
- Medium6.4HTML File Upload
WordPress
≤3.6Update to 3.6.1
- Medium6.1Cross-Site Scripting
Design Approval System
≤3.6Update to 3.7