Database
WordPress vulnerabilities listed in CISA KEV (page 1365)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2011-3865 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3856 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3858 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3864 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3852 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3855 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3857 | — | |
| High7.1 | Cross-Site Scripting | CVE-2011-3853 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-3863 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3854 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3861 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3851 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3859 | — | |
| Critical9.8 | SQL Injection | CVE-2015-2216 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-1068 | — | |
| Critical9.8 | SQL Injection | CVE-2012-1067 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2012-1205 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2011-3981 | — | |
| Critical9.8 | SQL Injection | CVE-2011-5216 | — | |
| Critical9.8 | Remote File Download | CVE-2011-4106 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-4568 | — | |
| High8.8 | SQL Injection | CVE-2011-5286 | — | |
| Medium5.3 | Username Enumeration | CVE-2011-3126 | — | |
| Medium6.3 | Security Hardening | CVE-2011-3125 | — | |
| Medium6.3 | Media Related Security Issue | CVE-2011-3122 | — | |
| High8.8 | SQL Injection | CVE-2011-3130 | — | |
| High8.8 | Arbitrary File Upload | CVE-2011-3129 | — | |
| Medium4.3 | Sensitive Information Disclosure | CVE-2011-3128 | — | |
| High7.1 | Clickjacking | CVE-2011-3127 | — | |
| Critical9.8 | Unauthenticated Remote Code Execution | CVE-2011-10033 | — |
- Medium6.1Cross-Site Scripting
Black-Letterhead
<1.6Update to 1.6
- Medium6.1Cross-Site Scripting
Elegant Grunge
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Pixiv Custom
<2.1.6Update to 2.1.6
- Medium6.1Cross-Site Scripting
The Erudite
≤2.7.8Update to 2.8
- Medium6.1Cross-Site Scripting
evolve
<1.2.7Update to 1.2.7
- Medium6.1Cross-Site Scripting
F8 Lite
≤4.2.1Update to 4.2.2
- Medium6.1Cross-Site Scripting
Antisnews
≤1.09Update to 1.10
- High7.1Cross-Site Scripting
Hybrid
<0.10Update to 0.10
- Medium6.1Reflected Cross-Site Scripting
RedLine
<1.66Update to 1.66
- Medium6.1Cross-Site Scripting
ZenLite
≤4.3Update to 4.4
- Medium6.1Cross-Site Scripting
Web Minimalist 200901
≤1.1No patch available
- Medium6.1Cross-Site Scripting
News
≤0.1Update to 0.2
- Medium6.1Cross-Site Scripting
Trending
<0.2Update to 0.2
- Critical9.8SQL Injection
Photocrati
≤4.0Update to 4.1
- Medium6.1Cross-Site Scripting
WP-RecentComments
<2.0.7Update to 2.0.7
- Critical9.8SQL Injection
WP-RecentComments
≤2.0.7Update to 2.1
- Critical9.8Remote File Inclusion
Relocate Upload
<0.20Update to 0.20
- Critical9.8Remote File Inclusion
AllWebMenus WordPress Menu Plugin
≤1.1.3Update to 1.1.4
- Critical9.8SQL Injection
SCORM Cloud For WordPress
<1.0.7Update to 1.0.7
- Critical9.8Remote File Download
TimThumb
<2.0Update to 2.0
- Medium6.1Cross-Site Scripting
FV Flowplayer Video Player
≤1.2.11Update to 1.2.12
- High8.8SQL Injection
Social Slider
<7.4.2Update to 7.4.2
- Medium5.3Username Enumeration
WordPress
≤3.1.2Update to 3.1.3
- Medium6.3Security Hardening
WordPress
≤3.1.2Update to 3.1.3
- Medium6.3Media Related Security Issue
WordPress
≤3.1.2Update to 3.2
- High8.8SQL Injection
WordPress
≤3.1.2Update to 3.1.3
- High8.8Arbitrary File Upload
WordPress
≤3.1.2Update to 3.1.3
- Medium4.3Sensitive Information Disclosure
WordPress
≤3.1.2Update to 3.1.3
- High7.1Clickjacking
WordPress
≤3.1.2Update to 3.1.3
- Critical9.8Unauthenticated Remote Code Execution
is-human
≤1.4.2No patch available