CVE-2013-3487: Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin...

Security readout for executives and security teams

This is an old WordPress plugin issue in BulletProof Security before version .49. Attackers could inject script or HTML into the plugin’s security log through unspecified HTTP header fields tied to error pages. The main concern is browser-side compromise when a privileged user views affected log content. Exposure is likely limited to WordPress sites running BulletProof Security versions earlier than .49. Sites without this plugin, or running .49 or later, are not shown by the supplied sources as affected. Prioritize this for any legacy WordPress estate still using old BulletProof Security versions. It is not enough evidence for emergency response by itself, but stale security plugins on public sites deserve prompt cleanup because administrator-session impact is plausible. Mitigation focus: Inventory WordPress sites for the BulletProof Security plugin.; Upgrade BulletProof Security to version .49 or later.; Check the WordPress plugin changelog and vendor guidance before deployment..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.