Database
WordPress vulnerabilities listed in CISA KEV (page 1368)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Sensitive Information Disclosure | CVE-2009-2334 | — | |
| Medium5.3 | Username Enumeration | CVE-2009-2335 | — | |
| Critical9.8 | SQL Injection | CVE-2009-2383 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2009-2396 | — | |
| Critical10.0 | SQL Injection | CVE-2009-2144 | — | |
| Critical9.8 | SQL Injection | CVE-2009-2122 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2009-2143 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2009-2431 | — | |
| Critical9.8 | Local File Inclusion | CVE-2009-4672 | — | |
| Critical9.8 | Remote Code Execution | CVE-2009-2852 | — | |
| Critical9.8 | SQL Injection | CVE-2009-0968 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2009-1030 | — | |
| High7.2 | Cross-Site Scripting | CVE-2008-5278 | — | |
| High7.5 | Directory Traversal | CVE-2008-5752 | — | |
| Medium5.3 | Denial of Service | CVE-2008-6767 | — | |
| Medium6.1 | Open Redirect | CVE-2008-6762 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2008-6811 | — | |
| Critical9.8 | SQL Injection | CVE-2008-4625 | — | |
| Critical9.8 | SQL Injection | CVE-2008-4732 | — | |
| High7.2 | SQL Injection | CVE-2008-4733 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2008-4734 | — | |
| Medium6.5 | Cryptographic Weakness | CVE-2008-4107 | — | |
| High8.1 | Arbitrary User Password Reset | CVE-2008-4106 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2008-4671 | — | |
| Medium5.9 | Cryptographic Weakness | CVE-2008-3747 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2008-3362 | — | |
| High7.2 | Cross-Site Scripting | CVE-2008-3233 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-7321 | — | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2008-7175 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2008-2034 | — |
- Medium6.1Sensitive Information Disclosure
WordPress
≤2.8Update to 2.8.1
- Medium5.3Username Enumeration
WordPress
≤2.8Update to 2.8.1
- Critical9.8SQL Injection
Related Sites
≤2.2Update to 2.2.1
- Critical9.8Remote File Inclusion
dm-albums
≤1.9.2Update to 1.9.3
- Critical10.0SQL Injection
firestats
<1.6.2Update to 1.6.2
- Critical9.8SQL Injection
Photoracer Plugin
≤1.0No patch available
- Critical9.8Remote File Inclusion
firestats
<1.6.2Update to 1.6.2
- Medium5.3Sensitive Information Disclosure
WordPress
≤2.7.1Update to 2.8
- Critical9.8Local File Inclusion
wp-lytebox
≤1.3No patch available
- Critical9.8Remote Code Execution
WP-Syntax
≤0.9.9Update to 0.9.10
- Critical9.8SQL Injection
fmoblog
≤2.1No patch available
- Medium6.4Cross-Site Scripting
WordPress MU
<2.7Update to 2.7
- High7.2Cross-Site Scripting
WordPress
≤2.6.4Update to 2.6.5
- High7.5Directory Traversal
page-flip-image-gallery
≤0.2.2No patch available
- Medium5.3Denial of Service
WordPress
≤2.6.1Update to 2.7
- Medium6.1Open Redirect
WordPress
<2.8.1Update to 2.8.1
- Critical9.8Arbitrary File Upload
WP e-Commerce
≤3.4Update to 3.6.8 RC1
- Critical9.8SQL Injection
ShiftThis
≤2.3.1No patch available
- Critical9.8SQL Injection
WP Comment Remix
<1.4.4Update to 1.4.4
- High7.2SQL Injection
WP Comment Remix
≤1.4.3Update to 1.4.4
- High8.8Cross-Site Request Forgery
WP Comment Remix
<1.4.4Update to 1.4.4
- Medium6.5Cryptographic Weakness
WordPress
≤2.6.1Update to 2.6.2
- High8.1Arbitrary User Password Reset
WordPress
≤2.6.1Update to 2.6.2
- Medium6.4Cross-Site Scripting
WordPress MU
<2.6Update to 2.6
- Medium5.9Cryptographic Weakness
WordPress
≤2.6Update to 2.6.1
- Critical9.8Arbitrary File Upload
Downloads Manager
≤0.2No patch available
- High7.2Cross-Site Scripting
WordPress
<2.6Update to 2.6
- Medium6.1Cross-Site Scripting
TubePress
≤1.5.7Update to 1.6.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤1.9.0Update to 1.9.1
- Critical9.8Unauthenticated SQL Injection
Download Monitor
≤2.0.6Update to 2.0.9