Database
WordPress vulnerabilities listed in CISA KEV (page 1369)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Cross-Site Scripting | CVE-2008-2068 | — | |
| High7.5 | Directory Traversal | CVE-2008-4769 | — | |
| High7.2 | Arbitrary File Upload | CVE-2008-2392 | — | |
| High8.1 | Authentication Bypass | CVE-2008-1930 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2008-1982 | — | |
| Critical9.8 | SQL Injection | CVE-2008-1646 | — | |
| Critical9.8 | Remote Code Execution | CVE-2008-1060 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-1061 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0939 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2008-1059 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0845 | — | |
| Critical9.8 | SQL Injection | CVE-2008-7040 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-0837 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2008-1304 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0683 | — | |
| Medium5.3 | Directory Traversal | CVE-2008-0615 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-0617 | — | |
| High7.2 | SQL Injection | CVE-2008-0616 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-0618 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0682 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2008-0691 | — | |
| Critical9.1 | SQL injection | CVE-2008-0491 | — | |
| Critical9.8 | 1.4.3 - SQL Injection | CVE-2008-0520 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0507 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0490 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2008-0508 | — | |
| Critical9.8 | Remote SQL Injection | CVE-2008-0388 | — | |
| High7.3 | Authorization Bypass | CVE-2008-4616 | — | |
| High7.5 | CAPTCHA Bypass | CVE-2008-7216 | — | |
| Medium6.1 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2008-0197 | — |
- Medium6.4Cross-Site Scripting
WordPress
≤2.5Update to 2.5.1
- High7.5Directory Traversal
WordPress
≤2.5Update to 2.5.1
- High7.2Arbitrary File Upload
WordPress
≤2.5.1Update to 2.5.2
- High8.1Authentication Bypass
WordPress
≤2.5Update to 2.5.1
- Critical9.8Unauthenticated SQL Injection
WordPress Spreadsheet
≤0.6No patch available
- Critical9.8SQL Injection
WP-Download
≤1.2Update to 1.2.1
- Critical9.8Remote Code Execution
Sniplets
<1.2.3Update to 1.2.3
- Medium6.1Cross-Site Scripting
Sniplets
<1.2.3Update to 1.2.3
- Critical9.8SQL Injection
WP Photo Album Plus
≤1.0Update to 1.1
- Critical9.8Remote File Inclusion
Sniplets
<1.2.3Update to 1.2.3
- Critical9.8SQL Injection
WP People
≤3.4.1No patch available
- Critical9.8SQL Injection
Yellow Swordfish Simple Forum
≤1.11No patch available
- Medium6.1Cross-Site Scripting
Search Unleashed
≤0.2.10Update to 0.2.11
- Medium6.4Cross-Site Scripting
WordPress
≤2.3.2Update to 2.3.3
- Critical9.8SQL Injection
ShiftThis
all versionsNo patch available
- Medium5.3Directory Traversal
DMSGuestbook
≤1.8.0Update to 1.8.1
- Medium6.1Cross-Site Scripting
DMSGuestbook
<1.9.0Update to 1.9.0
- High7.2SQL Injection
DMSGuestbook
all versionsNo patch available
- Medium6.1Cross-Site Scripting
DMSGuestbook
<1.9.0Update to 1.9.0
- Critical9.8SQL Injection
WordSpew
≤3.71No patch available
- Medium6.1Multiple Cross-Site Scripting
WP-Footnotes
≤2.2Update to 3.0
- Critical9.1SQL injection
fgallery
≤2.4.1Update to 2.4.2
- Critical9.81.4.3 - SQL Injection
WassUp Real Time Analytics
1.4 – 1.4.3Update to 1.4.4
- Critical9.8SQL Injection
AdServe
≤0.2Update to 0.3
- Critical9.8SQL Injection
wp-cal
≤0.3No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dean's Permalinks Migration
≤1.0No patch available
- Critical9.8Remote SQL Injection
wp-forum
≤1.7.4Update to 1.7.7
- High7.3Authorization Bypass
SpamBam
≤2.1No patch available
- High7.5CAPTCHA Bypass
Peter's Math Anti-Spam
≤0.1.6Update to 1.0.0
- Medium6.1Authenticated (Admin+) Stored Cross-Site Scripting
WP-ContactForm
≤1.5No patch available