Database

WordPress vulnerabilities listed in CISA KEV (page 1372)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

WordPress vulnerabilities listed in CISA KEV (page 1372)
Severity	Vulnerability	CVE	Installs	Published
Medium6.5	Directory Traversal WordPress<2.1Update to 2.1	CVE-2007-0541	—	Jan 24, 2007
Medium4.3	Denial of Service WordPress<2.1Update to 2.1	CVE-2007-0539	—	Jan 22, 2007
Medium5.3	Full Path Disclosure WordPress≤2.0.11Update to 2.1	CVE-2008-0195	—	Jan 22, 2007
High8.8	SQL Injection WordPress≤2.0.6Update to 2.0.7	CVE-2007-0233	—	Jan 15, 2007
Medium5.3	Full Path Disclosure WordPress≤2.0.6Update to 2.0.7	CVE-2007-0262	—	Jan 15, 2007
Medium6.4	Cross-Site Scripting WordPress≤2.0.5Update to 2.0.6	CVE-2006-6808	—	Jan 5, 2007
High8.8	Cross-Site Request Forgery to Cross-Site Scripting WordPress≤2.0.5Update to 2.0.6	CVE-2007-0106	—	Jan 5, 2007
Medium5.3	2.0.5 - Sensitive Information Disclosure WordPress2.0.2 – 2.0.5Update to 2.0.6	CVE-2006-4743	—	Jan 5, 2007
Critical9.8	SQL Injection WordPress≤2.0.5Update to 2.0.6	CVE-2007-0107	—	Jan 5, 2007
Medium5.3	Username Enumeration via Error Messages WordPress≤2.0.5Update to 2.0.6	CVE-2007-0109	—	Jan 5, 2007
Medium6.5	Denial of Service WordPress≤2.0.4Update to 2.0.5	CVE-2006-6017	—	Oct 27, 2006
Medium6.5	Directory Traversal WordPress≤2.0.4Update to 2.0.5	CVE-2006-5705	—	Oct 27, 2006
Medium6.1	Cross-Site Scripting Headway<3.8.9Update to 3.8.9	CVE-2016-10953	—	Oct 13, 2006
Medium4.3	User Metadata Information Disclosure WordPress≤2.0.4Update to 2.0.5	CVE-2006-6016	—	Sep 18, 2006
Medium6.1	Reflected Cross-Site Scripting Subscribe to Comments≤2.0.7Update to 2.0.8	CVE-2006-10001	—	Sep 17, 2006
Medium5.5	Authenticated (Admin+) Directory Traversal Skippy WP-DB Backup (Legacy Core Plugin)≤1.7No patch available	CVE-2006-4208	—	Aug 14, 2006
Medium5.3	Full Path Disclosure WordPress<1.5.2Update to 1.5.2	CVE-2005-4463	—	Aug 14, 2006
Medium6.5	Denial of Service WordPress≤2.0.3Update to 2.0.4	CVE-2008-0194	—	Jul 29, 2006
Medium5.3	Full Path Disclosure WordPress≤2.0.3Update to 2.0.4	CVE-2006-3390	—	Jul 29, 2006
Critical9.8	Privilege Escalation WordPress<2.0.4Update to 2.0.4	CVE-2006-4028	—	Jul 9, 2006
High8.8	Remote Code Execution WordPress≤2.0.2Update to 2.0.3	CVE-2006-2667	—	Jun 1, 2006
Medium5.3	IP Address Spoofing WordPress≤2.0.2Update to 2.0.3	CVE-2006-2702	—	Jun 1, 2006
Medium6.1	Cross-Site Scripting WordPress<2.0.2Update to 2.0.2	CVE-2007-5105	—	Mar 10, 2006
High7.5	Sensitive Information Disclosure WordPress≤2.0.1Update to 2.0.2	CVE-2006-0986	—	Mar 10, 2006
Medium6.1	Reflected Cross-Site Scripting WordPress<2.0.2Update to 2.0.2	CVE-2006-1263	—	Mar 10, 2006
High7.2	Cross-Site Scripting WordPress≤2.0.1Update to 2.0.2	CVE-2006-0985	—	Mar 10, 2006
Medium6.1	Cross-Site Scripting WordPress≤2.0Update to 2.0.1	CVE-2006-1796	—	Jan 31, 2006
High7.2	SQL Injection WordPress≤1.5.2Update to 2.0	CVE-2006-1012	—	Dec 31, 2005
Medium5.3	Directory Traversal secure-files≤1.1Update to 1.2	CVE-2005-10002	—	Oct 3, 2005
High8.8	Remote Code Execution WordPress≤1.5.1.3Update to 1.5.2	CVE-2005-2612	—	Aug 9, 2005

Medium6.5
Directory Traversal
WordPress
<2.1Update to 2.1
CVE-2007-0541Jan 24, 2007
Medium4.3
Denial of Service
WordPress
<2.1Update to 2.1
CVE-2007-0539Jan 22, 2007
Medium5.3
Full Path Disclosure
WordPress
≤2.0.11Update to 2.1
CVE-2008-0195Jan 22, 2007
High8.8
SQL Injection
WordPress
≤2.0.6Update to 2.0.7
CVE-2007-0233Jan 15, 2007
Medium5.3
Full Path Disclosure
WordPress
≤2.0.6Update to 2.0.7
CVE-2007-0262Jan 15, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤2.0.5Update to 2.0.6
CVE-2006-6808Jan 5, 2007
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
WordPress
≤2.0.5Update to 2.0.6
CVE-2007-0106Jan 5, 2007
Medium5.3
2.0.5 - Sensitive Information Disclosure
WordPress
2.0.2 – 2.0.5Update to 2.0.6
CVE-2006-4743Jan 5, 2007
Critical9.8
SQL Injection
WordPress
≤2.0.5Update to 2.0.6
CVE-2007-0107Jan 5, 2007
Medium5.3
Username Enumeration via Error Messages
WordPress
≤2.0.5Update to 2.0.6
CVE-2007-0109Jan 5, 2007
Medium6.5
Denial of Service
WordPress
≤2.0.4Update to 2.0.5
CVE-2006-6017Oct 27, 2006
Medium6.5
Directory Traversal
WordPress
≤2.0.4Update to 2.0.5
CVE-2006-5705Oct 27, 2006
Medium6.1
Cross-Site Scripting
Headway
<3.8.9Update to 3.8.9
CVE-2016-10953Oct 13, 2006
Medium4.3
User Metadata Information Disclosure
WordPress
≤2.0.4Update to 2.0.5
CVE-2006-6016Sep 18, 2006
Medium6.1
Reflected Cross-Site Scripting
Subscribe to Comments
≤2.0.7Update to 2.0.8
CVE-2006-10001Sep 17, 2006
Medium5.5
Authenticated (Admin+) Directory Traversal
Skippy WP-DB Backup (Legacy Core Plugin)
≤1.7No patch available
CVE-2006-4208Aug 14, 2006
Medium5.3
Full Path Disclosure
WordPress
<1.5.2Update to 1.5.2
CVE-2005-4463Aug 14, 2006
Medium6.5
Denial of Service
WordPress
≤2.0.3Update to 2.0.4
CVE-2008-0194Jul 29, 2006
Medium5.3
Full Path Disclosure
WordPress
≤2.0.3Update to 2.0.4
CVE-2006-3390Jul 29, 2006
Critical9.8
Privilege Escalation
WordPress
<2.0.4Update to 2.0.4
CVE-2006-4028Jul 9, 2006
High8.8
Remote Code Execution
WordPress
≤2.0.2Update to 2.0.3
CVE-2006-2667Jun 1, 2006
Medium5.3
IP Address Spoofing
WordPress
≤2.0.2Update to 2.0.3
CVE-2006-2702Jun 1, 2006
Medium6.1
Cross-Site Scripting
WordPress
<2.0.2Update to 2.0.2
CVE-2007-5105Mar 10, 2006
High7.5
Sensitive Information Disclosure
WordPress
≤2.0.1Update to 2.0.2
CVE-2006-0986Mar 10, 2006
Medium6.1
Reflected Cross-Site Scripting
WordPress
<2.0.2Update to 2.0.2
CVE-2006-1263Mar 10, 2006
High7.2
Cross-Site Scripting
WordPress
≤2.0.1Update to 2.0.2
CVE-2006-0985Mar 10, 2006
Medium6.1
Cross-Site Scripting
WordPress
≤2.0Update to 2.0.1
CVE-2006-1796Jan 31, 2006
High7.2
SQL Injection
WordPress
≤1.5.2Update to 2.0
CVE-2006-1012Dec 31, 2005
Medium5.3
Directory Traversal
secure-files
≤1.1Update to 1.2
CVE-2005-10002Oct 3, 2005
High8.8
Remote Code Execution
WordPress
≤1.5.1.3Update to 1.5.2
CVE-2005-2612Aug 9, 2005