Database
WordPress vulnerabilities listed in CISA KEV (page 1358)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2013-6280 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-3258 | — | |
| High8.8 | Remote Code Execution | CVE-2013-2109 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2107 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-10021 | — | |
| Critical9.8 | SQL Injection | CVE-2013-3478 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-3257 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3252 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3477 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3479 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2707 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3254 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2702 | — | |
| High7.6 | Cross-Site Request Forgery | CVE-2013-2703 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2013-2709 | — | |
| High7.1 | Cross-Site Request Forgery | CVE-2013-2696 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-10028 | — | |
| Critical9.8 | SQL Injection | CVE-2013-3532 | — | |
| Critical9.8 | SQL Injection | CVE-2013-3530 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3526 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-1949 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-2697 | — | |
| High7.1 | Cross-Site Request Forgery | CVE-2013-2693 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2013-3720 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-7476 | — | |
| High7.2 | Cross-Site Scripting | CVE-2013-3529 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2700 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2741 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2743 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2742 | — |
- Medium6.1Cross-Site Scripting
Social Sharing Toolkit
<2.1.2Update to 2.1.2
- Medium6.3Cross-Site Request Forgery
digg-digg
<5.3.5Update to 5.3.5
- High8.8Remote Code Execution
WP CleanFix
<5.0.0Update to 5.0.0
- High8.8Cross-Site Request Forgery
Mail On Update
<5.3.0Update to 5.3.0
- Medium6.1Reflected Cross-Site Scripting
Debug Bar
≤0.8Update to 0.8.1
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
<2.1Update to 2.1
- Medium4.3Cross-Site Request Forgery
Related Posts
<2.7.2Update to 2.7.2
- High8.8Cross-Site Request Forgery
WP-PostViews
<1.63Update to 1.63
- High8.8Cross-Site Request Forgery
Related Posts by Zemanta
≤1.3.1Update to 1.3.2
- High8.8Cross-Site Request Forgery
share-this
≤7.0.5Update to 7.0.6
- Medium6.3Cross-Site Request Forgery
AJAX Auth – Fast Logins, 2FA, Redirects
<3.1Update to 3.1
- Medium6.1Cross-Site Scripting
WP Photo Album Plus
<5.0.3Update to 5.0.3
- Medium6.3Cross-Site Request Forgery
Easy Plugin for AdSense
<6.10Update to 6.10
- High7.6Cross-Site Request Forgery
Facebook Members
<5.0.5Update to 5.0.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
FourSquare Checkins
<1.3Update to 1.3
- High7.1Cross-Site Request Forgery
WP Webmaster
<8.2.4Update to 8.2.4
- Medium6.1Reflected Cross-Site Scripting
EELV Newsletter
≤3.3.0Update to 3.3.1
- Critical9.8SQL Injection
SpiderVPlayer
≤2.1No patch available
- Critical9.8SQL Injection
Spiffy XSPF Player
≤0.1No patch available
- Medium6.1Cross-Site Scripting
Traffic Analyzer
≤3.4.1Update to 3.4.2
- Critical9.8Arbitrary File Upload
Social Media Widget
≤4.0Update to 4.0.1
- Medium6.1Cross-Site Scripting
wp-download-manager
<1.61Update to 1.61
- High7.1Cross-Site Request Forgery
WP-Print
<2.52Update to 2.52
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Feedweb
<1.9Update to 1.9
- High8.8Cross-Site Request Forgery
Simple Fields
<1.2Update to 1.2
- High7.2Cross-Site Scripting
WP FuneralPress
≤1.1.6Update to 1.1.7
- High8.8Cross-Site Request Forgery
WP125
≤1.4.9Update to 1.5.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0