Database

WordPress vulnerabilities listed in CISA KEV (page 1367)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

WordPress vulnerabilities listed in CISA KEV (page 1367)
Severity	Vulnerability	CVE	Installs	Published
Medium5.3	Spam Protection Bypass WordPress<3.0.2Update to 3.0.2	CVE-2010-5293	—	Nov 30, 2010
High7.2	Stored Cross-Site Scripting Register Plus≤3.5.11No patch available	CVE-2010-4402	—	Nov 24, 2010
Medium5.3	Sensitive Information Disclosure Register Plus≤3.5.11No patch available	CVE-2010-4403	—	Nov 24, 2010
Critical9.8	SQL Injection Event Registration<6.00.03Update to 6.00.03	CVE-2010-4839	—	Nov 15, 2010
Medium6.1	Cross-Site Scripting WP Survey And Quiz Tool<1.3Update to 1.3	CVE-2010-4630	—	Nov 8, 2010
Medium6.1	Reflected Cross-Site Scripting FeedList≤2.61.03Update to 2.70.00	CVE-2010-4637	—	Nov 5, 2010
Medium6.1	Reflected Cross-Site Scripting vodpod-video-gallery≤3.1.7No patch available	CVE-2010-4875	—	Nov 5, 2010
Medium6.1	Cross-Site Scripting cformsII≤11.5Update to 11.6.1	CVE-2010-3977	—	Nov 2, 2010
Medium4.7	Missing Authorization WordPress<3.0.1Update to 3.0.1	CVE-2010-5297	—	Jul 29, 2010
Critical9.8	SQL Injection myLinksDump≤1.2No patch available	CVE-2010-2924	—	Jul 22, 2010
Medium6.1	Cross-Site Scripting Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery<1.5.2Update to 1.5.2	CVE-2010-1186	—	Apr 6, 2010
Medium4.3	Authorization Bypass WordPress<2.9.2Update to 2.9.2	CVE-2010-0682	—	Feb 15, 2010
Critical9.8	Copperleaf Photolog <= 0.16- SQL injection Copperleaf Photolog≤0.16No patch available	CVE-2010-0673	—	Feb 15, 2010
Critical9.8	SQL Injection Pyrmont V2≤2.0.7No patch available	CVE-2009-4424	—	Dec 18, 2009
High8.8	Arbitrary File Upload WordPress≤2.8.5Update to 2.8.6	CVE-2009-3890	—	Dec 12, 2009
Medium6.4	Cross-Site Scripting WordPress≤2.8.5Update to 2.8.6	CVE-2009-3891	—	Dec 12, 2009
Medium6.1	Cross-Site Scripting via tagcloud WP Cumulus≤1.22Update to 1.23	CVE-2009-4168	—	Dec 2, 2009
Medium5.3	Sensitive Information Exposure WP Cumulus≤1.20Update to 1.23	CVE-2009-4170	—	Nov 25, 2009
High8.8	Arbitrary File Upload Piwik PRO0.2.35 – 0.4.3Update to 0.4.4	CVE-2009-4140	—	Oct 21, 2009
Medium6.5	Denial of Service WordPress≤2.8.4Update to 2.8.5	CVE-2009-3622	—	Oct 20, 2009
Critical9.8	Multiple SQL Injections wp-forum<2.4Update to 2.4	CVE-2009-3703	—	Sep 28, 2009
High7.1	Cross-Site Scripting WP Cumulus<1.22Update to 1.22	CVE-2009-4169	—	Sep 27, 2009
Medium5.3	Full Path Disclosure WordPress≤2.8Update to 2.8.1	CVE-2009-2432	—	Sep 8, 2009
High7.5	Forced Password Reset WordPress≤2.8.3Update to 2.8.4	CVE-2009-2762	—	Aug 12, 2009
High7.3	Missing Authorization WordPress≤2.8.2Update to 2.8.3	CVE-2009-2854	—	Aug 3, 2009
High7.3	Authorization Bypass WordPress≤2.8.2Update to 2.8.3	CVE-2009-2853	—	Aug 3, 2009
Medium6.1	Cross-Site Scripting Analyticator<5.2.1Update to 5.2.1	CVE-2009-5158	—	Jul 29, 2009
High7.2	Cross-Site Scripting WordPress≤2.8.1Update to 2.8.2	CVE-2009-2851	—	Jul 20, 2009
Medium6.4	SQL Injection my-category-order≤2.8.7Update to 3.0.1	CVE-2009-4748	—	Jul 15, 2009
Medium5.3	Username Enumeration WordPress≤2.8Update to 2.8.1	CVE-2009-2336	—	Jul 9, 2009

Medium5.3
Spam Protection Bypass
WordPress
<3.0.2Update to 3.0.2
CVE-2010-5293Nov 30, 2010
High7.2
Stored Cross-Site Scripting
Register Plus
≤3.5.11No patch available
CVE-2010-4402Nov 24, 2010
Medium5.3
Sensitive Information Disclosure
Register Plus
≤3.5.11No patch available
CVE-2010-4403Nov 24, 2010
Critical9.8
SQL Injection
Event Registration
<6.00.03Update to 6.00.03
CVE-2010-4839Nov 15, 2010
Medium6.1
Cross-Site Scripting
WP Survey And Quiz Tool
<1.3Update to 1.3
CVE-2010-4630Nov 8, 2010
Medium6.1
Reflected Cross-Site Scripting
FeedList
≤2.61.03Update to 2.70.00
CVE-2010-4637Nov 5, 2010
Medium6.1
Reflected Cross-Site Scripting
vodpod-video-gallery
≤3.1.7No patch available
CVE-2010-4875Nov 5, 2010
Medium6.1
Cross-Site Scripting
cformsII
≤11.5Update to 11.6.1
CVE-2010-3977Nov 2, 2010
Medium4.7
Missing Authorization
WordPress
<3.0.1Update to 3.0.1
CVE-2010-5297Jul 29, 2010
Critical9.8
SQL Injection
myLinksDump
≤1.2No patch available
CVE-2010-2924Jul 22, 2010
Medium6.1
Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<1.5.2Update to 1.5.2
CVE-2010-1186Apr 6, 2010
Medium4.3
Authorization Bypass
WordPress
<2.9.2Update to 2.9.2
CVE-2010-0682Feb 15, 2010
Critical9.8
Copperleaf Photolog <= 0.16- SQL injection
Copperleaf Photolog
≤0.16No patch available
CVE-2010-0673Feb 15, 2010
Critical9.8
SQL Injection
Pyrmont V2
≤2.0.7No patch available
CVE-2009-4424Dec 18, 2009
High8.8
Arbitrary File Upload
WordPress
≤2.8.5Update to 2.8.6
CVE-2009-3890Dec 12, 2009
Medium6.4
Cross-Site Scripting
WordPress
≤2.8.5Update to 2.8.6
CVE-2009-3891Dec 12, 2009
Medium6.1
Cross-Site Scripting via tagcloud
WP Cumulus
≤1.22Update to 1.23
CVE-2009-4168Dec 2, 2009
Medium5.3
Sensitive Information Exposure
WP Cumulus
≤1.20Update to 1.23
CVE-2009-4170Nov 25, 2009
High8.8
Arbitrary File Upload
Piwik PRO
0.2.35 – 0.4.3Update to 0.4.4
CVE-2009-4140Oct 21, 2009
Medium6.5
Denial of Service
WordPress
≤2.8.4Update to 2.8.5
CVE-2009-3622Oct 20, 2009
Critical9.8
Multiple SQL Injections
wp-forum
<2.4Update to 2.4
CVE-2009-3703Sep 28, 2009
High7.1
Cross-Site Scripting
WP Cumulus
<1.22Update to 1.22
CVE-2009-4169Sep 27, 2009
Medium5.3
Full Path Disclosure
WordPress
≤2.8Update to 2.8.1
CVE-2009-2432Sep 8, 2009
High7.5
Forced Password Reset
WordPress
≤2.8.3Update to 2.8.4
CVE-2009-2762Aug 12, 2009
High7.3
Missing Authorization
WordPress
≤2.8.2Update to 2.8.3
CVE-2009-2854Aug 3, 2009
High7.3
Authorization Bypass
WordPress
≤2.8.2Update to 2.8.3
CVE-2009-2853Aug 3, 2009
Medium6.1
Cross-Site Scripting
Analyticator
<5.2.1Update to 5.2.1
CVE-2009-5158Jul 29, 2009
High7.2
Cross-Site Scripting
WordPress
≤2.8.1Update to 2.8.2
CVE-2009-2851Jul 20, 2009
Medium6.4
SQL Injection
my-category-order
≤2.8.7Update to 3.0.1
CVE-2009-4748Jul 15, 2009
Medium5.3
Username Enumeration
WordPress
≤2.8Update to 2.8.1
CVE-2009-2336Jul 9, 2009