Database
WordPress vulnerabilities listed in CISA KEV (page 1359)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Sensitive Information Disclosure | CVE-2013-2744 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2013-2640 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-0731 | — | |
| High7.2 | SQL Injection | CVE-2013-1852 | — | |
| Medium6.1 | Cross-Site Scripting via playerID | CVE-2013-2714 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2013-2501 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7472 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-7480 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-0734 | — | |
| Critical9.8 | SQL Injection | CVE-2013-0735 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1765 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1759 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1758 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1808 | — | |
| High7.5 | 1.9.11 - Full Path Disclosure | CVE-2013-0291 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2013-0286 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2013-10023 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2013-0724 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-1409 | — | |
| High7.2 | Multiple SQL Injections | CVE-2013-1408 | — | |
| Critical9.8 | Unauthenticated Remote File Inclusion | CVE-2012-4919 | — | |
| Medium6.1 | Cross-Site Scripting via playerID Parameter | CVE-2013-1464 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2013-0237 | — | |
| Medium5.4 | Server-Side Request Forgery | CVE-2013-0235 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2013-0236 | — | |
| Critical9.8 | SQL Injection | CVE-2013-1401 | — | |
| Critical9.8 | SQL Injection | CVE-2013-1400 | — | |
| High7.5 | Directory Traversal | CVE-2012-4920 | — | |
| High7.5 | Directory Traversal | CVE-2012-4915 | — | |
| High7.5 | Directory Traversal | CVE-2014-5465 | — |
- Medium5.3Sensitive Information Disclosure
BackupBuddy
<3.0Update to 3.0
- Medium6.4Cross-Site Scripting
MailUp newsletter sign-up form
<1.3.2Update to 1.3.2
- Medium6.1Cross-Site Scripting
MailUp newsletter sign-up form
<1.3.3Update to 1.3.3
- High7.2SQL Injection
LeagueManager
<3.8.1Update to 3.8.1
- Medium6.1Cross-Site Scripting via playerID
podpress
≤8.8.10.17No patch available
- Medium6.4Stored Cross-Site Scripting
Terillion Reviews
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Count per Day
<3.2.6Update to 3.2.6
- Medium6.1Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.3.6Update to 5.3.6.1
- High7.2Stored Cross-Site Scripting
Mingle Forum
≤1.0.33.3Update to 1.0.34
- Critical9.8SQL Injection
Mingle Forum
≤1.0.33.3Update to 1.0.34
- Medium6.1Cross-Site Scripting
Smart Flv
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Responsive Logo Slideshow
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Marekkis Watermark-Plugin
≤0.9.4No patch available
- Medium6.1Cross-Site Scripting
Zendesk Chat
<1.2.6Update to 1.2.6
- High7.51.9.11 - Full Path Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
1.9.10 – 1.9.11Update to 2.0.0
- Medium5.4Cross-Site Scripting
Pinboard
≤1.1.11Update to 1.1.12
- High7.2Authenticated (Admin+) SQL Injection
Editorial Calendar
≤2.6Update to 2.7
- Critical9.8Remote File Inclusion
WP eCommerce Shop Styling
<1.8Update to 1.8
- Medium6.1Reflected Cross-Site Scripting
CommentLuv
<2.92.4Update to 2.92.4
- High7.2Multiple SQL Injections
MailPoet Newsletters (Previous)
≤2.2Update to 2.2.1
- Critical9.8Unauthenticated Remote File Inclusion
WordPress Gallery Plugin
≤1.4No patch available
- Medium6.1Cross-Site Scripting via playerID Parameter
audio-player
<2.0.4.6Update to 2.0.4.6
- Medium6.4Cross-Site Scripting
WordPress
≤3.5Update to 3.5.1
- Medium5.4Server-Side Request Forgery
WordPress
≤3.5Update to 3.5.1
- Medium6.4Stored Cross-Site Scripting
WordPress
<3.5.1Update to 3.5.1
- Critical9.8SQL Injection
WordPress Poll
≤34.05Update to 34.06
- Critical9.8SQL Injection
WordPress Poll
≤34.05Update to 34.06
- High7.5Directory Traversal
Forums
<1.4.4Update to 1.4.4
- High7.5Directory Traversal
Google Doc Embedder
<2.5.4Update to 2.5.4
- High7.5Directory Traversal
Download Shortcode
≤0.2.3Update to 1.0