Try installing a WordPress plugin called "TimThumb Vulnerability Scanner" and running a scan. If it comes up with outdated TimThumb code, it gives...
Separate names with a comma.