Updated 43 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

549new WordPress flaws this week

391,964entries in the database

5,872 results · page 101 of 118

Oct 6, 2016Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1CVE-2015-1000013 · WordPress plugins & themes · reported by MITREHigh 7.8
Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1
Affected
1.1 to 1.1
What to do
Affects 1.1 to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Local File Inclusion Vulnerability in mypixs v0.3 wordpress pluginCVE-2015-1000012 · WordPress plugins & themes · reported by MITREHigh 7.5
Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin
Affected
0.3 to 0.3
What to do
Affects 0.3 to 0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Blind SQL Injection in wordpress plugin dukapress v2.5.9CVE-2015-1000011 · WordPress plugins & themes · reported by MITRECritical 9.8
Blind SQL Injection in wordpress plugin dukapress v2.5.9
Affected
2.5.9 to 2.5.9
What to do
Affects 2.5.9 to 2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Remote file download in simple-image-manipulator v1.0 wordpress pluginCVE-2015-1000010 · WordPress plugins & themes · reported by MITREHigh 7.5
Remote file download in simple-image-manipulator v1.0 wordpress plugin
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05CVE-2015-1000009 · WordPress plugins & themes · reported by MITRECritical 9.1
Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05
Affected
1.05 to 1.05
What to do
Affects 1.05 to 1.05. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com vapidlabs.com
Oct 6, 2016Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2CVE-2015-1000008 · WordPress plugins & themes · reported by MITREMedium 5.3
Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2
Affected
2.3.2 to 2.3.2
What to do
Affects 2.3.2 to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com vapidlabs.com
Oct 6, 2016Remote file download vulnerability in recent-backups v0.7 wordpress pluginCVE-2015-1000006 · WordPress plugins & themes · reported by MITREHigh 7.5
Remote file download vulnerability in recent-backups v0.7 wordpress plugin
Affected
0.7 to 0.7
What to do
Affects 0.7 to 0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Remote file download vulnerability in candidate-application-form v1.0 wordpress pluginCVE-2015-1000005 · WordPress plugins & themes · reported by MITREHigh 7.5
Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016XSS in filedownload v1.4 wordpress pluginCVE-2015-1000004 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS in filedownload v1.4 wordpress plugin
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Blind SQL Injection in filedownload v1.4 wordpress pluginCVE-2015-1000003 · WordPress plugins & themes · reported by MITRECritical 9.8
Blind SQL Injection in filedownload v1.4 wordpress plugin
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Open Proxy in filedownload v1.4 wordpress pluginCVE-2015-1000002 · WordPress plugins & themes · reported by MITREHigh 8.2
Open Proxy in filedownload v1.4 wordpress plugin
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Remote file upload vulnerability in fast-image-adder v1.1 Wordpress pluginCVE-2015-1000001 · WordPress plugins & themes · reported by MITRECritical 9.8
Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Remote file upload vulnerability in mailcwp v1.99 wordpress pluginCVE-2015-1000000 · WordPress plugins & themes · reported by MITRECritical 9.8
Remote file upload vulnerability in mailcwp v1.99 wordpress plugin
Affected
1.99 to 1.99
What to do
Affects 1.99 to 1.99. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com vapidlabs.com
Aug 7, 2016the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5: Cross-site request forgery (CSRF)CVE-2016-6635 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.
Product
the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5
Fixed in
4.5
What to do
Update the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 to 4.5 or newer.
Full record and what to do →NVD record codex.wordpress.org debian.org
Aug 7, 2016the network settings page in WordPress before 4.5: Cross-site scripting (XSS)CVE-2016-6634 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
the network settings page in WordPress before 4.5
Fixed in
4.5
What to do
Update the network settings page in WordPress before 4.5 to 4.5 or newer.
Full record and what to do →NVD record codex.wordpress.org debian.org
Aug 7, 2016WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass anCVE-2016-4029 · WordPress plugins & themes · reported by MITREHigh 8.6
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
Fixed in
4.5
What to do
Update the plugin to 4.5 or newer.
Full record and what to do →NVD record codex.wordpress.org debian.org
Aug 2, 2016Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2016-4833 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Nofollow Links
Fixed in
1.0.11
What to do
Update Cross-site scripting (XSS) vulnerability in the Nofollow Links to 1.0.11 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.CVE-2016-5839 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.CVE-2016-5838 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.CVE-2016-5837 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.CVE-2016-5836 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/inCVE-2016-5835 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3: Cross-site scripting (XSS)CVE-2016-5834 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
Product
the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3
Fixed in
4.5.3
What to do
Update the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3: Cross-site scripting (XSS)CVE-2016-5833 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
Product
the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3
Fixed in
4.5.3
What to do
Update the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 to 4.5.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jun 29, 2016The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.CVE-2016-5832 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 25, 2016The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of tCVE-2016-4828 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account.
Product
Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 25, 2016Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web scriCVE-2016-4827 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826.
Product
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 25, 2016Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web scriCVE-2016-4826 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4827.
Product
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 25, 2016The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code vCVE-2016-4825 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.6
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.
Product
Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 4, 2016Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web scriCVE-2016-4812 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved
Fixed in
2.5.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved to 2.5.1 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
May 21, 2016flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2,: Cross-site scripting (XSS)CVE-2016-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Product
flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2,
Fixed in
2.21.0
What to do
Update flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, to 2.21.0 or newer.
Full record and what to do →NVD record openwall.com securitytracker.com
May 21, 2016plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2,: Cross-site scripting (XSS)CVE-2016-4566 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.
Product
plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2,
Fixed in
2.1.9
What to do
Update plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, to 2.1.9 or newer.
Full record and what to do →NVD record openwall.com plupload.com
May 21, 2016The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attackCVE-2016-2222 · WordPress plugins & themes · reported by security@debian.orgHigh 8.6
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
Fixed in
4.4.2
What to do
Update the plugin to 4.4.2 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 21, 2016the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2: Open redirectCVE-2016-2221 · WordPress plugins & themes · reported by security@debian.orgHigh 7.4
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
Product
the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2
Fixed in
4.4.2
What to do
Update the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 to 4.4.2 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 21, 2016Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web sCVE-2016-1564 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.
Fixed in
4.4.1
What to do
Update the plugin to 4.4.1 or newer.
Full record and what to do →NVD record twitter.com debian.org
May 21, 2016wp-includes/wp-db.php in WordPress before 4.2.2: Cross-site scripting (XSS)CVE-2015-8834 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.
Product
wp-includes/wp-db.php in WordPress before 4.2.2
Fixed in
4.2.2
What to do
Update wp-includes/wp-db.php in WordPress before 4.2.2 to 4.2.2 or newer.
Full record and what to do →NVD record debian.org codex.wordpress.org
May 21, 2016the user list table in WordPress before 4.3.1: Cross-site scripting (XSS)CVE-2015-7989 · WordPress plugins & themes · reported by security@debian.orgMedium 5.4
Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.
Product
the user list table in WordPress before 4.3.1
Fixed in
4.3.1
What to do
Update the user list table in WordPress before 4.3.1 to 4.3.1 or newer.
Full record and what to do →NVD record debian.org debian.org
May 21, 2016The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypassCVE-2015-5715 · WordPress plugins & themes · reported by MITREMedium 4.3
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
Fixed in
4.3.1
What to do
Update the plugin to 4.3.1 or newer.
Full record and what to do →NVD record debian.org debian.org
May 21, 2016WordPress before 4.3.1: Cross-site scripting (XSS)CVE-2015-5714 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
Product
WordPress before 4.3.1
Fixed in
4.3.1
What to do
Update WordPress before 4.3.1 to 4.3.1 or newer.
Full record and what to do →NVD record debian.org debian.org
May 14, 2016The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST reqCVE-2016-1209 · WordPress plugins & themes · reported by vultures@jpcert.or.jpCritical 9.8
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
Product
Ninja Forms
Fixed in
2.9.42.1
What to do
Update Ninja Forms to 2.9.42.1 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 25, 2016Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTCVE-2016-1160 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the WP Favorite Posts
Fixed in
1.6.6
What to do
Update Cross-site scripting (XSS) vulnerability in the WP Favorite Posts to 1.6.6 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jan 12, 2016Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary fiCVE-2015-5471 · WordPress plugins & themes · reported by MITREMedium 5.3
Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Product
Swim Team
Affected
1.44.10777 to 1.44.10777
What to do
Affects 1.44.10777 to 1.44.10777. Update Swim Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record michaelwalsh.org packetstormsecurity.com
Jan 12, 2016Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary filesCVE-2015-4703 · WordPress plugins & themes · reported by MITREMedium 5.3
Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter.
Product
WordPress Rename
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update WordPress Rename to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Jan 8, 2016Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTCVE-2014-7151 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the form_fields parameter in a (1) do_edit or (2) do_insert action to wp-admin/admin-ajax.php.
Product
NEX-Forms Lite
Affected
2.1.0 to 2.1.0
What to do
Affects 2.1.0 to 2.1.0. Update NEX-Forms Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.g0blin.co.uk wpvulndb.com
Jan 8, 2016Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject arbitrary web scriptCVE-2014-6444 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) t parameter to iframe-googlefont-preview.php or the (2) text parameter to iframe-font-preview.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework
Fixed in
1.6
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework to 1.6 or newer.
Full record and what to do →NVD record research.g0blin.co.uk wpvulndb.com
Jan 8, 2016Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via aCVE-2015-4694 · WordPress plugins & themes · reported by MITREHigh 8.6
Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.
Product
Directory traversal vulnerability in download.php in the Zip Attachments
Fixed in
1.5.1
What to do
Update Directory traversal vulnerability in download.php in the Zip Attachments to 1.5.1 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Dec 29, 2015Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrarCVE-2015-7791 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.3
Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) search[column] or (2) switch parameter.
Product
Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart
Fixed in
1.5.3
What to do
Update Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart to 1.5.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Dec 17, 2015lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of prevCVE-2015-7527 · WordPress plugins & themes · reported by Red HatHigh 7.5
lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of preview image" and possibly other input fields in the "Video Gallery Settings" page.
Product
Cool Video Gallery
Affected
1.9 to 1.9
What to do
Affects 1.9 to 1.9. Update Cool Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Nov 9, 2015the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5734 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.
Product
the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5733 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title.
Product
the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.