Database
WordPress vulnerabilities listed in CISA KEV (page 1364)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2012-5349 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5192 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2012-0287 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-5346 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5207 | — | |
| Medium6.1 | Authorization Bypass | CVE-2011-5254 | — | |
| High8.8 | Arbitrary File Upload | CVE-2011-5051 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2011-5226 | — | |
| Critical9.8 | SQL Injection | CVE-2011-5224 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5225 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5191 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5264 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-4595 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5180 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-4624 | — | |
| High7.1 | Cross-Site Scripting | CVE-2011-5179 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5265 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5181 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5107 | — | |
| Medium5.3 | Stored Cross-Site Scripting | CVE-2011-5104 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5106 | — | |
| Critical9.8 | SQL Injection | CVE-2011-4671 | — | |
| High7.3 | SQL Injection | CVE-2011-4803 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3860 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2011-5328 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2011-5257 | — | |
| Critical9.8 | SQL Injection | CVE-2011-4669 | — | |
| High8.8 | SQL Injection | CVE-2011-4646 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3862 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3850 | — |
- Medium6.1Cross-Site Scripting
Pay With Tweet
≤1.1Update to 1.2
- Medium6.1Cross-Site Scripting
Pretty Link Lite
<1.5.6Update to 1.5.6
- Medium6.4Cross-Site Scripting
WordPress
≤3.3Update to 3.3.1
- Medium6.1Cross-Site Scripting
WP Live.php
≤1.2.1Update to 1.3
- Medium6.1Cross-Site Scripting
TheCartPress eCommerce Shopping Cart
≤1.1.5Update to 1.1.6
- Medium6.1Authorization Bypass
Connections Business Directory
≤0.7.1.5Update to 0.7.1.6
- High8.8Arbitrary File Upload
WP Symposium
<11.12.24Update to 11.12.24
- High8.8Cross-Site Request Forgery
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Critical9.8SQL Injection
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
Pretty Link Lite
<1.5.4Update to 1.5.4
- Medium6.1Reflected Cross-Site Scripting
Lazyest Backup
<0.2.2Update to 0.2.2
- Medium6.1Reflected Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.5.6Update to 1.5.6
- Medium6.1Reflected Cross-Site Scripting
ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast – HTML5
≤1.11No patch available
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<1.57Update to 1.57
- High7.1Cross-Site Scripting
Skysa App Bar Integration
≤1.03Update to 1.04
- Medium6.1Cross-Site Scripting
Featurific For WordPress
≤1.6.2No patch available
- Medium6.1Cross-Site Scripting
Live Chat from ClickDesk – Live Chat – Help Desk Plugin for Websites
≤2.0Update to 3.0
- Medium6.1Cross-Site Scripting
Alert Before Your Post
≤0.1.1No patch available
- Medium5.3Stored Cross-Site Scripting
WP eCommerce
<3.8.7.2Update to 3.8.7.2
- Medium6.1Cross-Site Scripting
Flexible Custom Post Type
<0.1.7Update to 0.1.7
- Critical9.8SQL Injection
AdRotate Banner Manager
<3.6.8Update to 3.6.8
- High7.3SQL Injection
WPtouch – Make your WordPress Website Mobile-Friendly
<1.9.8.1Update to 1.9.8.1
- Medium6.1Cross-Site Scripting
Cover WP
≤1.6.5Update to 1.6.6
- High8.8Cross-Site Request Forgery
User Access Manager
<1.2Update to 1.2
- Medium6.4Stored Cross-Site Scripting
Classipress
≤3.1.4Update to 3.1.5
- Critical9.8SQL Injection
WordPress Users
≤1.3Update to 1.4
- High8.8SQL Injection
WP-PostRatings
≤1.61Update to 1.62
- Medium6.1Cross-Site Scripting
Morning Coffee
<3.6Update to 3.6
- Medium6.1Cross-Site Scripting
Atahualpa
<3.6.8Update to 3.6.8