Database
WordPress vulnerabilities listed in CISA KEV (page 1361)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-10013 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-10014 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2012-10017 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2012-10015 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6714 | — | |
| Critical9.8 | Directory Traversal | CVE-2012-6652 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20005 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6713 | — | |
| Medium6.1 | Cross-Site Request Forgery | CVE-2013-2108 | — | |
| Medium4.3 | Information Disclosure | CVE-2012-3385 | — | |
| Medium4.3 | Sensitive Information Disclosure | CVE-2012-6635 | — | |
| Medium6.5 | Cross-Site Scripting | CVE-2012-6633 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2012-6634 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2012-3384 | — | |
| Low3.7 | Informational < 6.8 - Weak Hashing Algorithm | CVE-2012-6707 | — | |
| Critical9.8 | SQL Injection | CVE-2018-12534 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10011 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10020 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-6649 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3575 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10064 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3578 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3574 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-2633 | — | |
| Critical9.8 | Remote File Upload | CVE-2012-10027 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3577 | — | |
| Critical9.8 | Brute Force Bypass | CVE-2012-10001 | — | |
| High7.5 | Arbitrary File Read | CVE-2012-3588 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2012-6715 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10026 | — |
- Medium6.1Reflected Cross-Site Scripting
Backend Localization
1.6.1 – 1.6.1Update to 2.0
- Medium6.1Reflected Cross-Site Scripting
Backend Localization
≤2.0Update to 2.0.1
- Medium4.3Cross-Site Request Forgery
Portfolio Plugin
≤2.04Update to 2.05
- Medium4.3Cross-Site Request Forgery
BestWebSoft's Twitter
≤2.14Update to 2.15
- Medium6.1Cross-Site Scripting
Count per Day
<3.2.3Update to 3.2.3
- Critical9.8Directory Traversal
A Page Flip Book
<3.0Update to 3.0
- Medium6.1Reflected Cross-Site Scripting
socialfit
≤1.2.2No patch available
- Medium6.1Cross-Site Scripting
Job Manager
≤0.7.18Update to 0.7.19
- Medium6.1Cross-Site Request Forgery
WP CleanFix
≤3.0.1Update to 3.0.2
- Medium4.3Information Disclosure
WordPress
≤3.4Update to 3.4.1
- Medium4.3Sensitive Information Disclosure
WordPress
<3.3.3Update to 3.3.3
- Medium6.5Cross-Site Scripting
WordPress
<3.3.3Update to 3.3.3
- Medium5.3Sensitive Information Disclosure
WordPress
<3.3.3Update to 3.3.3
- High8.8Cross-Site Request Forgery
WordPress
≤3.4Update to 3.4.1
- Low3.7Informational < 6.8 - Weak Hashing Algorithm
WordPress
<6.8Update to 6.8
- Critical9.8SQL Injection
Quick Chat
<4.00Update to 4.00
- Critical9.8Arbitrary File Upload
HD FLV PLayer
≤1.7Update to 1.8
- Critical9.8Arbitrary File Upload
FoxyPress
<0.4.2.2Update to 0.4.2.2
- Critical9.8Arbitrary File Upload
WP GPX Maps – GPX, FIT & KML maps with elevation profile
<1.1.23Update to 1.1.23
- Critical9.8Arbitrary File Upload
rbxgallery
<3.1Update to 3.1
- Critical9.8Arbitrary File Upload
Omni Secure Files
≤0.1.13Update to 0.1.14
- Critical9.8Arbitrary File Upload
FCChat Widget
<2.2.13.7Update to 2.2.13.7
- Critical9.8Arbitrary File Upload
mm-forms-community
≤2.2.6Update to 2.2.7
- Medium6.1Cross-Site Scripting
WassUp Real Time Analytics
<1.8.3.1Update to 1.8.3.1
- Critical9.8Remote File Upload
WP-Property – WordPress Powered Real Estate and Property Management
≤1.35.0Update to 1.35.1
- Critical9.8Arbitrary File Upload
Nmedia WordPress Member Conversation
<1.4Update to 1.4
- Critical9.8Brute Force Bypass
Limit Login Attempts
≤1.7.0Update to 1.7.1
- High7.5Arbitrary File Read
Plugin: Newsletter
≤1.5No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
FormBuilder
≤0.90Update to 0.91
- Critical9.8Arbitrary File Upload
Asset Manager
≤0.3No patch available