Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

489 results · page 10 of 10

Jan 27, 2018The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray paramCVE-2018-6357 · WordPress plugins & themes · reported by MITREHigh 8.8
The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.
Product
acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget
Fixed in
3.2.6
What to do
Update acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget to 3.2.6 or newer.
Full record and what to do →NVD record lists.openwall.net wordpress.org
Jan 18, 2018WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).CVE-2018-5776 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
Fixed in
4.9.2
What to do
Update the plugin to 4.9.2 or newer.
Full record and what to do →NVD record codex.wordpress.org github.com
Jan 9, 2018In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-seaCVE-2018-5310 · WordPress plugins & themes · reported by MITREMedium 6.5
In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI.
Product
In the "Media from FTP
Fixed in
9.85
What to do
Update In the "Media from FTP to 9.85 or newer.
Full record and what to do →NVD record github.com wordpress.org
Dec 27, 2017The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter.CVE-2017-17869 · WordPress plugins & themes · reported by MITREMedium 6.1
The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Oct 23, 2017The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.CVE-2017-15811 · WordPress plugins & themes · reported by MITREMedium 5.4
The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.
Product
Pootle Button
Fixed in
1.2.0
What to do
Update Pootle Button to 1.2.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Oct 12, 2017WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) aCVE-2016-9263 · WordPress plugins & themes · reported by MITREMedium 4.7
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com opnsec.com
May 18, 2017In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updCVE-2017-9064 · WordPress plugins & themes · reported by MITREHigh 8.8
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 11, 2017In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata.CVE-2017-6814 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record openwall.com debian.org
Jan 4, 2017Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackeCVE-2016-7168 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jun 29, 2016the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3: Cross-site scripting (XSS)CVE-2016-5833 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
Product
the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3
Fixed in
4.5.3
What to do
Update the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 to 4.5.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
May 21, 2016flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2,: Cross-site scripting (XSS)CVE-2016-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Product
flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2,
Fixed in
2.21.0
What to do
Update flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, to 2.21.0 or newer.
Full record and what to do →NVD record openwall.com securitytracker.com
Mar 3, 2015Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or CVE-2015-2195 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) paged, or (3) s parameter in the wp-media-cleaner page to wp-admin/upload.php.
Product
WP Media Cleaner
Affected
2.2.6 to 2.2.6
What to do
Affects 2.2.6 to 2.2.6. Update WP Media Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Nov 25, 2014the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1: Cross-site scripting (XSS)CVE-2014-9032 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1
Fixed in
3.9.x
What to do
Update the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 to 3.9.x or newer.
Full record and what to do →NVD record advisories.mageia.org openwall.com
Sep 26, 2014Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP cCVE-2014-5324 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file.
Product
Unrestricted file upload vulnerability in the N-Media file uploader
Fixed in
3.4
What to do
Update Unrestricted file upload vulnerability in the N-Media file uploader to 3.4 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jul 2, 2014Cross-site scripting (XSS) vulnerability in uploader.php in the WP Silverlight Media Player (wp-media-player) plugin 0.8 and earlier for WordPress allows remoteCVE-2014-4589 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in uploader.php in the WP Silverlight Media Player (wp-media-player) plugin 0.8 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.
Product
WP Silverlight Media Player (wp-media-player)
Affected
up to 0.8
What to do
Affects up to 0.8. Update WP Silverlight Media Player (wp-media-player) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com exchange.xforce.ibmcloud.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in tpls/editmedia.php in the Hot Files: File Sharing and Download Manager (wphotfiles) plugin 1.0.0 and earlier for WorCVE-2014-4588 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in tpls/editmedia.php in the Hot Files: File Sharing and Download Manager (wphotfiles) plugin 1.0.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mediaid parameter.
Product
Hot Files: File Sharing and Download Manager (wphotfiles)
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Hot Files: File Sharing and Download Manager (wphotfiles) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in admin/admin_show_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows remote attackers to inCVE-2014-4582 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin_show_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the dialog_id parameter.
Product
WP Consultant
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Consultant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in services/diagnostics.php in the WordPress Social Login plugin 2.0.3 and earlier for WordPress allows remote attackerCVE-2014-4576 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in services/diagnostics.php in the WordPress Social Login plugin 2.0.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the xhrurl parameter.
Product
WordPress Social Login
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update WordPress Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and earlier for WordPress allows remote attackers to inject CVE-2014-4551 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the testing parameter.
Product
Social Connect
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress allow remote attackerCVE-2014-4543 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fcolor, (2) links, (3) stitle, (4) height, (5) width, (6) host, (7) bcolor, (8) msg, (9) id, or (10) size parameter.
Product
Pay Per Media Player
Affected
up to 1.24
What to do
Affects up to 1.24. Update Pay Per Media Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com securityfocus.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers tCVE-2014-4524 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter.
Product
Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types
Fixed in
1.4.4
What to do
Update Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types to 1.4.4 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in pq_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote attackers to inject arbCVE-2014-4545 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in pq_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) leftorright or (2) author parameter.
Product
Pro Quoter
Affected
up to 1.0
What to do
Affects up to 1.0. Update Pro Quoter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com securityfocus.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inCVE-2014-4516 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the param parameter.
Product
BIC Media Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update BIC Media Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in mce_anyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attackers to inject arbitCVE-2014-4515 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in mce_anyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the text parameter.
Product
AnyFont
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update AnyFont to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com securityfocus.com
Mar 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settiCVE-2014-2040 · WordPress plugins & themes · reported by MITRELow 2.1
Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file.
Product
Media File Renamer
Affected
1.7.0 to 1.7.0
What to do
Affects 1.7.0 to 1.7.0. Update Media File Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jan 20, 2014wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions viaCVE-2012-6634 · WordPress plugins & themes · reported by MITREMedium 6.4
wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.
Fixed in
3.3.3
What to do
Update the plugin to 3.3.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web scCVE-2012-6630 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) bulk parameter to media-library-categories/add.php or (2) q parameter to media-library-categories/view.php.
Product
Media Library Categories
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update Media Library Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Dec 23, 2013Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in thCVE-2013-7102 · WordPress plugins & themes · reported by Red HatMedium 6.8
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.
Fixed in
1.61
What to do
Update the plugin to 1.61 or newer.
Full record and what to do →NVD record blog.sucuri.net help.optimizepress.com
Sep 10, 2013SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands viCVE-2013-5673 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php.
Product
IndiaNIC Testimonial
What to do
Update IndiaNIC Testimonial to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Sep 10, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authenticatCVE-2013-5672 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add a testimonial via an iNIC_testimonial_save action; (2) add a listing template via an iNIC_testimonial_save_listing_template action; (3) add a widget template via an iNIC_testimonial_save_widget action; insert cross-site scripting (XSS) sequences via the (4) project_name, (5) project_url, (6) client_name, (7) client_city, (8) client_state, (9) description, (10) tags, (11) video_url, or (12) is_featured, (13) title, (14) widget_title, (15) no_of_testimonials, (16) filter_by_country, (17) filter_by_tags, or (18) widget_template parameter to wp-admin/admin-ajax.php.
Product
IndiaNIC Testimonial
What to do
Update IndiaNIC Testimonial to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Jul 8, 2013moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a #CVE-2013-2204 · WordPress plugins & themes · reported by Red HatMedium 4.3
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record codex.wordpress.org wordpress.org
Apr 25, 2013Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers CVE-2013-1949 · WordPress plugins & themes · reported by Red HatMedium 5
Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers to force the upload of arbitrary files.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.sucuri.net it.slashdot.org
Aug 13, 2012Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to injectCVE-2012-4273 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.
Product
Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons
Fixed in
0.34
What to do
Update Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons to 0.34 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Aug 13, 2012Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrCVE-2012-4272 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "processing of the buttons of Xing and Pinterest".
Product
Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons
Fixed in
0.34
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons to 0.34 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 16, 2012Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbiCVE-2012-3577 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/user_uploads.
Product
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation
Fixed in
1.4
What to do
Update Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation to 1.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Mar 19, 2012The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknoCVE-2012-1786 · WordPress plugins & themes · reported by MITREMedium 5
The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
Product
Media Upload form in the Video Embed & Thumbnail Generator
Fixed in
2.0
What to do
Update Media Upload form in the Video Embed & Thumbnail Generator to 2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 10, 2011Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."CVE-2011-3122 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 14, 2011wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a mCVE-2011-0701 · WordPress plugins & themes · reported by Red HatMedium 4
wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.
Fixed in
3.0.5
What to do
Update the plugin to 3.0.5 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Apr 7, 2010Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitraCVE-2010-1186 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
Product
Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery
Fixed in
1.5.2
What to do
Update Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery to 1.5.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.