WordPress 3.5, released in December 2012, is now a legacy version carrying severe security risks. Our security audit found 201 documented vulnerabilities affecting this outdated platform, including 16 critical-level flaws that could allow attackers to take complete control of your website. If you're still running this version, your site is in immediate danger of being hacked, having your data stolen, or being used to attack other websites.
The vulnerabilities range from Remote Code Execution attacks that let hackers run malicious commands on your server, to SQL injection flaws that expose your entire database. Popular plugins like Social Warfare, Smart Google Code Inserter, and Astra Pro Addon contain critical security holes specific to older WordPress versions. This guide will help you determine if you're vulnerable and show you exactly how to fix the problem.
WordPress 3.5 is an extremely old version of WordPress, the platform that powers over 40% of all websites on the internet. It was released in 2012 and has been succeeded by dozens of newer versions. Like older software of any kind—whether it's operating systems, browsers, or applications—WordPress 3.5 no longer receives security updates from its developers. This means new security vulnerabilities discovered today will never be patched for version 3.5.
Think of WordPress 3.5 like driving a car from the 1980s without airbags, anti-lock brakes, or modern safety features. It might still run, but it's missing all the protective systems that modern vehicles have. Every day that passes, new security threats emerge that WordPress developers patch in current versions, but those fixes never reach version 3.5. This creates a widening security gap between your website and modern threats.
201 CVEs found. The most critical are explained below.
The Social Warfare plugin (versions up to 3.5.2) has a serious flaw that lets hackers run their own code directly on your website's server. This happens through a feature called 'swp_url' that doesn't properly check what data is being sent to it.
Impact: Attackers could take complete control of your website, steal customer data, install malware, send spam emails from your domain, or redirect visitors to malicious sites.
↗ View on NVDThe Oturia Smart Google Code Inserter plugin (before version 3.5) allows anyone on the internet to inject harmful code into your website without needing to log in. This code then runs on every page your visitors see.
Impact: Your website could display fake login forms to steal visitor credentials, inject advertisements, redirect users to scam sites, or spread malware to your visitors' computers.
↗ View on NVDThe same plugin has another critical flaw where attackers can send specially crafted requests to access your website's database without logging in. They can read, modify, or delete sensitive information stored there.
Impact: Hackers could steal all your customer information, payment details, user accounts, and any other data stored in your database, potentially exposing you to legal liability and loss of customer trust.
↗ View on NVDThe Astra Pro Addon plugin (before 3.5.2) has a flaw in its pagination features that allows attackers to send malicious requests to your database. The plugin doesn't properly validate this incoming data before using it.
Impact: Attackers could access, modify, or delete your database contents, including customer records, product information, and website configuration, without needing admin access.
↗ View on NVDThe Podlove Podcast Publisher plugin (before 3.5.6) has an optional Social & Donations module that doesn't properly validate contributor ID and category data before using it in database queries.
Impact: Attackers could exploit this to access or manipulate your database, steal listener information, or disrupt your podcast publishing functionality.
↗ View on NVDThe tagDiv Composer plugin (before 3.5, required by Newspaper and Newsmag themes) has a broken Facebook login feature that allows anyone to log into any user account on your site if they know that person's email address.
Impact: Attackers could impersonate any user on your website, including administrators, and gain full control over content, settings, and sensitive information without knowing any password.
↗ View on NVDShowing first 10 of 195. View all on NVD ↗
| CVE ID | Severity | Score | Published | Description |
|---|---|---|---|---|
| CVE-2021-24649 | CRITICAL | 9.8 | 2022-11-21 | The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created w… |
| CVE-2022-3180 | CRITICAL | 9.8 | 2025-02-11 | The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious… |
| CVE-2024-13421 | CRITICAL | 9.8 | 2025-02-12 | The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricti… |
| CVE-2025-1315 | CRITICAL | 9.8 | 2025-03-07 | The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the plugin not properly v… |
| CVE-2025-2505 | CRITICAL | 9.8 | 2025-03-20 | The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauth… |
| CVE-2025-1562 | CRITICAL | 9.8 | 2025-06-18 | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin instal… |
| CVE-2016-15043 | CRITICAL | 9.8 | 2025-07-19 | The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. T… |
| CVE-2025-15521 | CRITICAL | 9.8 | 2026-01-21 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and i… |
| CVE-2026-34424 | CRITICAL | 9.8 | 2026-04-09 | Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated … |
| CVE-2021-4374 | CRITICAL | 9.1 | 2023-06-07 | The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option v… |
| CVE-2012-2399 | HIGH | 10.0 | 2012-04-21 | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other pro… |
| CVE-2015-9322 | HIGH | 8.8 | 2019-08-16 | The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. |
| CVE-2015-5483 | HIGH | 8.8 | 2020-01-28 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for… |
| CVE-2020-35942 | HIGH | 8.8 | 2021-02-09 | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading t… |
| CVE-2021-24460 | HIGH | 8.8 | 2021-08-02 | The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL st… |
| CVE-2021-25076 | HIGH | 8.8 | 2022-01-24 | The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to a… |
| CVE-2022-0478 | HIGH | 8.8 | 2022-03-14 | The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL state… |
| CVE-2022-3357 | HIGH | 8.8 | 2022-10-31 | The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally… |
| CVE-2022-4290 | HIGH | 8.8 | 2023-10-20 | The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, and including, 3.5 due to insufficient es… |
| CVE-2023-5465 | HIGH | 8.8 | 2023-11-22 | The Popup with fancybox plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.5 due to insufficient escaping on the us… |
| CVE-2023-5448 | HIGH | 8.8 | 2024-01-11 | The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrec… |
| CVE-2024-1893 | HIGH | 8.8 | 2024-04-09 | The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2… |
| CVE-2024-3240 | HIGH | 8.8 | 2024-05-04 | The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input from the 'settings_e… |
| CVE-2025-1309 | HIGH | 8.8 | 2025-03-07 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalati… |
| CVE-2025-2891 | HIGH | 8.8 | 2025-04-01 | The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versi… |
| CVE-2025-3053 | HIGH | 8.8 | 2025-05-15 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 vi… |
| CVE-2025-8218 | HIGH | 8.8 | 2025-08-19 | The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and … |
| CVE-2025-11923 | HIGH | 8.8 | 2025-11-13 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a use… |
| CVE-2025-13641 | HIGH | 8.8 | 2025-12-18 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the … |
| CVE-2026-7467 | HIGH | 8.8 | 2026-05-20 | The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the 'RadMoreAjax::importData' func… |
| CVE-2023-2781 | HIGH | 8.1 | 2023-06-03 | The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. Thi… |
| CVE-2022-3899 | HIGH | 8.1 | 2024-01-16 | The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to cr… |
| CVE-2024-10828 | HIGH | 8.1 | 2024-11-13 | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted i… |
| CVE-2024-13800 | HIGH | 8.1 | 2025-02-12 | The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cp_dismiss_n… |
| CVE-2024-13655 | HIGH | 8.1 | 2025-03-07 | The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capabil… |
| CVE-2025-9243 | HIGH | 8.1 | 2025-10-04 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status f… |
| CVE-2014-2579 | HIGH | 7.6 | 2014-04-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests… |
| CVE-2021-24226 | HIGH | 7.5 | 2021-04-12 | In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serial… |
| CVE-2021-24893 | HIGH | 7.5 | 2022-01-03 | The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or… |
| CVE-2021-24881 | HIGH | 7.5 | 2023-01-23 | The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the pr… |
| CVE-2024-4838 | HIGH | 7.5 | 2024-05-16 | The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input from the 'settings_e… |
| CVE-2024-4469 | HIGH | 7.5 | 2024-05-31 | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a probl… |
| CVE-2025-2186 | HIGH | 7.5 | 2025-03-22 | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’… |
| CVE-2025-7504 | HIGH | 7.5 | 2025-07-12 | The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_vars parameter This makes it possible f… |
| CVE-2026-4373 | HIGH | 7.5 | 2026-03-21 | The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::s… |
| CVE-2024-10263 | HIGH | 7.3 | 2024-11-05 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This is due to the softw… |
| CVE-2025-6220 | HIGH | 7.2 | 2025-06-18 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions… |
| CVE-2025-6212 | HIGH | 7.2 | 2025-06-26 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient inpu… |
| CVE-2025-30608 | HIGH | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Anthony WordPress SQL Backup wordpress-sql-backup allows Stored XSS.This issue affects WordPress SQL Backup: from n/a through <=… |
| CVE-2025-11560 | HIGH | 7.1 | 2025-11-12 | The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, … |
| CVE-2014-8603 | MEDIUM | 6.5 | 2015-06-10 | cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) fil… |
| CVE-2020-35943 | MEDIUM | 6.5 | 2021-02-09 | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not incl… |
| CVE-2021-34647 | MEDIUM | 6.5 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in… |
| CVE-2023-6077 | MEDIUM | 6.5 | 2023-12-18 | The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any au… |
| CVE-2024-23517 | MEDIUM | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Start Booking Scheduling Plugin – Online Booking for WordPress allows Stored … |
| CVE-2024-1634 | MEDIUM | 6.5 | 2024-06-18 | The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsb_disconnect_sett… |
| CVE-2025-10938 | MEDIUM | 6.5 | 2025-11-21 | The UiPress lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.08. This is due to missing capability checks in the… |
| CVE-2026-2363 | MEDIUM | 6.5 | 2026-03-04 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'order_by' attribute of the [wpmem_user_membership_posts] shortcode in all versions up… |
| CVE-2026-3098 | MEDIUM | 6.5 | 2026-03-27 | The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function. This makes it possi… |
| CVE-2013-0235 | MEDIUM | 6.4 | 2013-07-08 | The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL f… |
| CVE-2021-34648 | MEDIUM | 6.4 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up… |
| CVE-2023-5232 | MEDIUM | 6.4 | 2023-09-28 | The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input … |
| CVE-2023-5662 | MEDIUM | 6.4 | 2023-11-22 | The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, and including, 3.5.0 due to insufficien… |
| CVE-2024-1424 | MEDIUM | 6.4 | 2024-04-09 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and in… |
| CVE-2024-3027 | MEDIUM | 6.4 | 2024-04-13 | The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and incl… |
| CVE-2024-3988 | MEDIUM | 6.4 | 2024-04-25 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stor… |
| CVE-2024-4333 | MEDIUM | 6.4 | 2024-05-14 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to DOM-… |
| CVE-2024-4373 | MEDIUM | 6.4 | 2024-05-15 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stor… |
| CVE-2024-5036 | MEDIUM | 6.4 | 2024-06-20 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stor… |
| CVE-2024-5260 | MEDIUM | 6.4 | 2024-07-02 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stor… |
| CVE-2024-6458 | MEDIUM | 6.4 | 2024-07-27 | The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_pres… |
| CVE-2024-7136 | MEDIUM | 6.4 | 2024-08-16 | The JetSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.5.2 due to insufficient input saniti… |
| CVE-2024-5867 | MEDIUM | 6.4 | 2024-09-13 | The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode in all versions up to, and including, 3.… |
| CVE-2024-5020 | MEDIUM | 6.4 | 2024-12-04 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due… |
| CVE-2024-12624 | MEDIUM | 6.4 | 2025-01-07 | The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up to, and including, … |
| CVE-2025-1529 | MEDIUM | 6.4 | 2025-05-01 | The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded lottie files in all versions up to, and including, 3.5.3 due to insufficient inp… |
| CVE-2024-4665 | MEDIUM | 6.4 | 2025-05-15 | The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally,… |
| CVE-2025-4610 | MEDIUM | 6.4 | 2025-05-17 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_user_memberships shortcode in all versions up to, and inc… |
| CVE-2025-4479 | MEDIUM | 6.4 | 2025-06-19 | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in al… |
| CVE-2025-6756 | MEDIUM | 6.4 | 2025-07-01 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and inc… |
| CVE-2025-5678 | MEDIUM | 6.4 | 2025-07-09 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all version… |
| CVE-2025-7495 | MEDIUM | 6.4 | 2025-07-22 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmem_login_link' shortcode in all versions up to, and includi… |
| CVE-2025-7966 | MEDIUM | 6.4 | 2025-07-24 | The Get Youtube Subs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘channel', 'layout', and 'subs_count’ parameters in all versions up to, and includin… |
| CVE-2025-3614 | MEDIUM | 6.4 | 2025-07-24 | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, an… |
| CVE-2025-11922 | MEDIUM | 6.4 | 2025-11-01 | The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3… |
| CVE-2025-11003 | MEDIUM | 6.4 | 2025-11-21 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
| CVE-2026-2868 | MEDIUM | 6.4 | 2026-05-05 | The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter in version… |
| CVE-2026-2948 | MEDIUM | 6.4 | 2026-05-05 | The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.5.3 via the… |
| CVE-2024-1851 | MEDIUM | 6.3 | 2024-03-08 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function i… |
| CVE-2017-1000038 | MEDIUM | 6.1 | 2017-07-17 | WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site |
| CVE-2017-15863 | MEDIUM | 6.1 | 2017-10-24 | Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php. |
| CVE-2019-9978 | MEDIUM | 6.1 | 2019-03-24 | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 201… |
| CVE-2017-18499 | MEDIUM | 6.1 | 2019-08-12 | The simple-membership plugin before 3.5.7 for WordPress has XSS. |
| CVE-2013-7475 | MEDIUM | 6.1 | 2019-08-13 | The contact-form-plugin plugin before 3.52 for WordPress has XSS. |
| CVE-2017-18615 | MEDIUM | 6.1 | 2019-09-13 | The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. |
| CVE-2021-34640 | MEDIUM | 6.1 | 2021-08-11 | The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attack… |
| CVE-2021-34664 | MEDIUM | 6.1 | 2021-08-16 | The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout.php file which allows attackers to inje… |
| CVE-2022-4953 | MEDIUM | 6.1 | 2023-08-14 | The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes tha… |
| CVE-2024-1273 | MEDIUM | 6.1 | 2024-03-11 | The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting a… |
| CVE-2024-9436 | MEDIUM | 6.1 | 2024-10-11 | The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of ad… |
| CVE-2024-9667 | MEDIUM | 6.1 | 2024-11-05 | The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all… |
| CVE-2024-10792 | MEDIUM | 6.1 | 2024-11-21 | The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' parameter in all version… |
| CVE-2024-11342 | MEDIUM | 6.1 | 2024-11-26 | The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing or incorrect nonce validati… |
| CVE-2022-3206 | MEDIUM | 5.9 | 2022-10-17 | The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at… |
| CVE-2024-5442 | MEDIUM | 5.9 | 2024-07-13 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
| CVE-2018-5212 | MEDIUM | 5.4 | 2018-01-04 | The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php. |
| CVE-2018-5213 | MEDIUM | 5.4 | 2018-01-04 | The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php. |
| CVE-2018-20368 | MEDIUM | 5.4 | 2018-12-23 | The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback. |
| CVE-2021-24382 | MEDIUM | 5.4 | 2021-06-14 | The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting … |
| CVE-2021-24577 | MEDIUM | 5.4 | 2021-10-11 | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon … |
| CVE-2022-0186 | MEDIUM | 5.4 | 2022-02-21 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low… |
| CVE-2021-24837 | MEDIUM | 5.4 | 2023-01-23 | The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site S… |
| CVE-2022-4472 | MEDIUM | 5.4 | 2023-01-30 | The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users wit… |
| CVE-2023-0660 | MEDIUM | 5.4 | 2023-03-27 | The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the sho… |
| CVE-2024-3237 | MEDIUM | 5.4 | 2024-05-04 | The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function in all versions up to… |
| CVE-2024-8239 | MEDIUM | 5.4 | 2024-09-30 | The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox sh… |
| CVE-2025-8102 | MEDIUM | 5.4 | 2025-08-20 | The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing nonce validations i… |
| CVE-2025-14448 | MEDIUM | 5.4 | 2026-01-15 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Select user profile fields in all version… |
| CVE-2026-4065 | MEDIUM | 5.4 | 2026-04-07 | The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smart-slider3 controller… |
| CVE-2026-2951 | MEDIUM | 5.4 | 2026-04-23 | The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.5 due t… |
| CVE-2022-4023 | MEDIUM | 5.3 | 2023-07-17 | The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to cr… |
| CVE-2024-3097 | MEDIUM | 5.3 | 2024-04-09 | The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in vers… |
| CVE-2023-7252 | MEDIUM | 5.3 | 2024-04-22 | The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets. |
| CVE-2024-6545 | MEDIUM | 5.3 | 2024-07-27 | The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin utilizing bootstrap and … |
| CVE-2024-6562 | MEDIUM | 5.3 | 2024-08-12 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This is due display_erro… |
| CVE-2024-10813 | MEDIUM | 5.3 | 2024-11-23 | The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,… |
| CVE-2024-12578 | MEDIUM | 5.3 | 2024-12-14 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the 'tickera_tickets_info' end… |
| CVE-2024-12176 | MEDIUM | 5.3 | 2025-01-07 | The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJAX action in all ver… |
| CVE-2025-11171 | MEDIUM | 5.3 | 2025-10-08 | The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the p… |
| CVE-2025-11816 | MEDIUM | 5.3 | 2025-11-01 | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missi… |
| CVE-2025-11271 | MEDIUM | 5.3 | 2025-11-06 | The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verificati… |
| CVE-2025-11991 | MEDIUM | 5.3 | 2025-12-16 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback func… |
| CVE-2025-12648 | MEDIUM | 5.3 | 2026-01-07 | The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user-uploaded files in p… |
| CVE-2010-4403 | MEDIUM | 5.0 | 2010-12-06 | The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.… |
| CVE-2014-8604 | MEDIUM | 5.0 | 2015-06-10 | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obt… |
| CVE-2014-8605 | MEDIUM | 5.0 | 2015-06-10 | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows … |
| CVE-2025-9489 | MEDIUM | 5.0 | 2025-09-09 | The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software… |
| CVE-2025-6348 | MEDIUM | 4.9 | 2025-07-30 | The Smart Slider 3 plugin for WordPress is vulnerable to time-based SQL Injection via the ‘sliderid’ parameter in all versions up to, and including, 3.5.1.28 due to insufficient e… |
| CVE-2026-7472 | MEDIUM | 4.9 | 2026-05-20 | The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7. This is due… |
| CVE-2026-9197 | MEDIUM | 4.9 | 2026-06-06 | The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function. This makes it possib… |
| CVE-2021-24296 | MEDIUM | 4.8 | 2021-05-24 | The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which… |
| CVE-2021-24658 | MEDIUM | 4.8 | 2021-08-23 | The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when t… |
| CVE-2021-24381 | MEDIUM | 4.8 | 2021-10-25 | The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users t… |
| CVE-2021-24713 | MEDIUM | 4.8 | 2021-11-23 | The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their … |
| CVE-2022-2118 | MEDIUM | 4.8 | 2022-07-17 | The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the u… |
| CVE-2023-5243 | MEDIUM | 4.8 | 2023-10-31 | The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored C… |
| CVE-2024-2444 | MEDIUM | 4.8 | 2024-04-06 | The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Sit… |
| CVE-2024-7955 | MEDIUM | 4.8 | 2024-09-10 | The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scr… |
| CVE-2024-6393 | MEDIUM | 4.8 | 2024-11-25 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as … |
| CVE-2024-2869 | MEDIUM | 4.8 | 2025-05-15 | The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored … |
| CVE-2025-12034 | MEDIUM | 4.4 | 2025-10-25 | The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due to insufficient input… |
| CVE-2010-4402 | MEDIUM | 4.3 | 2010-12-06 | Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web scri… |
| CVE-2013-2173 | MEDIUM | 4.3 | 2013-06-21 | wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service (CPU consumption) via a crafted value … |
| CVE-2013-0236 | MEDIUM | 4.3 | 2013-07-08 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery short… |
| CVE-2013-0237 | MEDIUM | 4.3 | 2013-07-08 | Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject… |
| CVE-2013-2199 | MEDIUM | 4.3 | 2013-07-08 | The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) i… |
| CVE-2013-2201 | MEDIUM | 4.3 | 2013-07-08 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of me… |
| CVE-2013-2202 | MEDIUM | 4.3 | 2013-07-08 | WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity … |
| CVE-2013-2203 | MEDIUM | 4.3 | 2013-07-08 | WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the a… |
| CVE-2013-2204 | MEDIUM | 4.3 | 2013-07-08 | moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) chara… |
| CVE-2013-2205 | MEDIUM | 4.3 | 2013-07-08 | The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy … |
| CVE-2014-100027 | MEDIUM | 4.3 | 2015-01-13 | Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted URL. |
| CVE-2022-0164 | MEDIUM | 4.3 | 2022-02-21 | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated… |
| CVE-2022-1842 | MEDIUM | 4.3 | 2022-06-27 | The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change th… |
| CVE-2022-4549 | MEDIUM | 4.3 | 2023-01-16 | The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a C… |
| CVE-2020-36741 | MEDIUM | 4.3 | 2023-07-01 | The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. This is due to missing or incorrect nonce validation on … |
| CVE-2021-4405 | MEDIUM | 4.3 | 2023-07-01 | The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on … |
| CVE-2021-4416 | MEDIUM | 4.3 | 2023-07-12 | The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing or incorrect nonce validation on the m… |
| CVE-2024-2298 | MEDIUM | 4.3 | 2024-03-08 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() functio… |
| CVE-2024-2476 | MEDIUM | 4.3 | 2024-03-29 | The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all versions up to, and inc… |
| CVE-2024-2744 | MEDIUM | 4.3 | 2024-05-17 | The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site S… |
| CVE-2023-6492 | MEDIUM | 4.3 | 2024-06-14 | The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to… |
| CVE-2024-5860 | MEDIUM | 4.3 | 2024-06-18 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_tickets AJAX action i… |
| CVE-2024-3163 | MEDIUM | 4.3 | 2024-09-12 | The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them… |
| CVE-2024-9540 | MEDIUM | 4.3 | 2024-10-16 | The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.7 via the render function in widget… |
| CVE-2024-11154 | MEDIUM | 4.3 | 2024-11-20 | The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
| CVE-2024-11709 | MEDIUM | 4.3 | 2024-12-12 | The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ai_post_generator_delete_Post A… |
| CVE-2024-12538 | MEDIUM | 4.3 | 2025-01-07 | The Duplicate Post, Page and Any Custom Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.5 via the 'dpp_duplicat… |
| CVE-2024-12826 | MEDIUM | 4.3 | 2025-01-25 | The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooh_action_settings_s… |
| CVE-2024-13883 | MEDIUM | 4.3 | 2025-02-21 | The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This is due to missing or incorrect nonce va… |
| CVE-2025-11815 | MEDIUM | 4.3 | 2025-11-21 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
| CVE-2025-14356 | MEDIUM | 4.3 | 2025-12-12 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_generated_pdf' function i… |
| CVE-2026-1298 | MEDIUM | 4.3 | 2026-01-28 | The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the `im… |
| CVE-2026-2608 | MEDIUM | 4.3 | 2026-02-17 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all ver… |
| CVE-2025-12356 | MEDIUM | 4.3 | 2026-02-18 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_change_ticket_… |
| CVE-2026-2294 | MEDIUM | 4.3 | 2026-03-21 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
| CVE-2026-1930 | MEDIUM | 4.3 | 2026-04-22 | The Emailchef plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the page_options_ajax_disconnect() function in all versi… |
| CVE-2013-2200 | MEDIUM | 4.0 | 2013-07-08 | WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reas… |
| CVE-2014-8606 | MEDIUM | 4.0 | 2015-06-10 | Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the fi… |
| CVE-2025-8013 | LOW | 3.8 | 2025-08-15 | The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunExternalScan' function… |
| CVE-2025-54352 | LOW | 3.7 | 2025-07-21 | WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior. |
| CVE-2013-10022 | LOW | 3.5 | 2023-04-05 | A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_… |
| CVE-2024-10545 | LOW | 3.5 | 2025-02-25 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as A… |
| CVE-2014-8607 | LOW | 2.1 | 2015-06-10 | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information… |
| CVE-2012-10025 | N/A | — | 2025-08-05 | The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configurati… |
Plain English · Fix recommendations · Instant PDF & HTML download
Scan your site in 30 seconds. Used by 500+ web agencies.
Running WordPress 3.5 in 2024 is like leaving your front door unlocked with a sign saying 'no valuables inside'—it's simply not worth the risk. The 201 vulnerabilities we found, especially the 16 critical-level flaws, represent real threats that hackers actively exploit. Your website isn't just at risk of being defaced or taken offline; it could be silently compromised to steal customer data, send spam, or distribute malware to your visitors.
Don't wait for a breach to happen. Use SiteRecipe.com's free vulnerability scanner to identify exactly which CVEs affect your website, get step-by-step upgrade guidance, and ensure your WordPress installation is secure. Our tools help you understand your security posture and fix vulnerabilities before attackers find them. Visit SiteRecipe.com today to scan your website and take control of your security.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.