Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
465 results · page 10 of 10
Jul 27, 2014Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.CVE-2014-4726 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.
- Product
- Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters)
- Fixed in
- 2.6.8
- What to do
- Update Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) to 2.6.8 or newer.
Full record and what to do →NVD recordopenwall.comwordpress.org
Jul 27, 2014The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code CVE-2014-4725 · WordPress plugins & themes · reported by MITREHigh 7.5
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.
- Product
- MailPoet Newsletters (wysija-newsletters)
- Fixed in
- 2.6.7
- What to do
- Update MailPoet Newsletters (wysija-newsletters) to 2.6.7 or newer.
Full record and what to do →NVD recordarstechnica.comblog.sucuri.net
Jul 11, 2014SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQCVE-2014-4939 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php.
- Product
- ENL Newsletter (enl-newsletter)
- Affected
- 1.0.1 to 1.0.1
- What to do
- Affects 1.0.1 to 1.0.1. Update ENL Newsletter (enl-newsletter) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-CVE-2014-4527 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-marketing-y-newsletters-gratis) plugin before 1.98 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) FormID or (2) AdministratorID parameter.
- Fixed in
- 1.98
- What to do
- Update the plugin to 1.98 or newer.
Full record and what to do →NVD recordcodevigilant.complugins.trac.wordpress.org
Mar 24, 2014Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrarCVE-2013-1408 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
- Product
- Multiple SQL injection vulnerabilities in the Wysija Newsletters
- Fixed in
- 2.2.1
- What to do
- Update Multiple SQL injection vulnerabilities in the Wysija Newsletters to 2.2.1 or newer.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Jan 16, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack theCVE-2012-6629 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Newsletter Manager
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecunia.comsecunia.com
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web sCVE-2012-6628 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php, (3) xyz_em_email parameter to admin/edit_email.php, (4) xyz_em_exportbatchSize parameter to import_export.php, or (5) pagination limit in the Newsletter Manager options.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager
- Fixed in
- 1.0.2
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager to 1.0.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Jan 16, 2014Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to injeCVE-2012-6627 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
- Product
- Newsletter Manager
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Aug 14, 2012Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.CVE-2012-4327 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.
- Product
- Unspecified vulnerability in the Image News slider
- Fixed in
- 3.3
- What to do
- Update Unspecified vulnerability in the Image News slider to 3.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com
Jun 19, 2012Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-3588 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.
- Product
- Plugin Newsletter
- What to do
- Update Plugin Newsletter to the newest version.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via theCVE-2011-3857 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
- Product
- Cross-site scripting (XSS) vulnerability in the Antisnews
- Fixed in
- 1.10
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Antisnews to 1.10 or newer.
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpageCVE-2011-3851 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
- Product
- Cross-site scripting (XSS) vulnerability in the News
- Fixed in
- 0.2
- What to do
- Update Cross-site scripting (XSS) vulnerability in the News to 0.2 or newer.
Oct 20, 2008stnl_iframe.php in the ShiftThis Newsletter: SQL injectionCVE-2008-4625 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter, a different vector than CVE-2008-0683.
- Product
- stnl_iframe.php in the ShiftThis Newsletter
- What to do
- Update stnl_iframe.php in the ShiftThis Newsletter to the newest version.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Feb 11, 2008shiftthis-preview.php in the ShiftThis Newsletter: SQL injectionCVE-2008-0683 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.
- Product
- shiftthis-preview.php in the ShiftThis Newsletter
- What to do
- Update shiftthis-preview.php in the ShiftThis Newsletter to the newest version.
Full record and what to do →NVD recordsecurityfocus.comexploit-db.com
Nov 26, 2005phpWordPress PHP News and Article Manager 3.0: SQL injectionCVE-2005-3844 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in phpWordPress PHP News and Article Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the (1) poll and (2) category parameters to index.php, and (3) the ctg parameter in an archive action.
- Product
- phpWordPress PHP News and Article Manager 3.0
- What to do
- Update phpWordPress PHP News and Article Manager 3.0 to the newest version.
Full record and what to do →NVD recordforum.word-press.netpridels0.blogspot.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.