Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

549new WordPress flaws this week

391,964entries in the database

5,872 results · page 102 of 118

Nov 9, 2015the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5732 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.
Product
the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015wp-admin/post.php in WordPress before 4.2.4: Cross-site request forgery (CSRF)CVE-2015-5731 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action.
Product
wp-admin/post.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update wp-admin/post.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgetCVE-2015-5730 · WordPress plugins & themes · reported by MITREMedium 5
The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.
Fixed in
4.2.4
What to do
Update the plugin to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4: SQL injectionCVE-2015-2213 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
Product
the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 2, 2015Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL comCVE-2015-5308 · WordPress plugins & themes · reported by Red HatHigh 7.5
Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.
Product
wp-championship
Affected
5.8 to 5.8
What to do
Affects 5.8 to 5.8. Update wp-championship to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org wpvulndb.com
Oct 16, 2015Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitrary files via a full CVE-2015-7683 · WordPress plugins & themes · reported by MITREMedium 4
Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitrary files via a full pathname in the url parameter to AjaxProxy.php.
Product
Absolute path traversal vulnerability in Font.php in the Font
Fixed in
7.5.1
What to do
Update Absolute path traversal vulnerability in Font.php in the Font to 7.5.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 16, 2015Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to exCVE-2015-7682 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register
Fixed in
2.0.19
What to do
Update Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register to 2.0.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 16, 2015Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to injeCVE-2015-7377 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
Product
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register
Fixed in
2.0.19
What to do
Update Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register to 2.0.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 29, 2015SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows rCVE-2015-7319 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
Product
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar
Fixed in
1.1.8
What to do
Update SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar to 1.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 28, 2015Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remoteCVE-2015-7386 · WordPress plugins & themes · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.
Product
Gallery - Photo Albums - Portfolio
Affected
1.3.47 to 1.3.47
What to do
Affects 1.3.47 to 1.3.47. Update Gallery - Photo Albums - Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 21, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary weCVE-2015-6238 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) ga_adsense, (2) ga_admin_disable_DimentionIndex, (3) ga_downloads_prefix, (4) ga_downloads, or (5) ga_outbound_prefix parameter in the google-analyticator page to wp-admin/admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator
Fixed in
6.4.9.6
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator to 6.4.9.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 17, 2015Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to executCVE-2015-7235 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
Product
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar
Fixed in
1.1.7
What to do
Update Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar to 1.1.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 16, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijackCVE-2015-6965 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) create a field, (2) update a field, (3) delete a field, (4) create a form, (5) update a form, (6) delete a form, (7) create a template, (8) update a template, (9) delete a template, or (10) conduct cross-site scripting (XSS) attacks via a crafted request to the cfg_forms page in wp-admin/admin.php.
Product
Contact Form Generator
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Contact Form Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 16, 2015Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allCVE-2015-6829 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP header.
Fixed in
2.0.1
What to do
Update the plugin to 2.0.1 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Sep 16, 2015The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloCVE-2015-6828 · WordPress plugins & themes · reported by MITREMedium 6.8
The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by modifying the client-server data stream. NOTE: some of these details are obtained from third party information.
Product
SecureMoz Security Audit
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update SecureMoz Security Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Sep 15, 2015Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via CVE-2015-5472 · WordPress plugins & themes · reported by MITREHigh 7.8
Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Product
Absolute path traversal vulnerability in lib/download.php in the IBS Mappro
Fixed in
1.0
What to do
Update Absolute path traversal vulnerability in lib/download.php in the IBS Mappro to 1.0 or newer.
Full record and what to do →NVD record vapid.dhs.org wordpress.org
Sep 11, 2015Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script CVE-2015-6920 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Product
sourceAFRICA
Affected
0.1.3 to 0.1.3
What to do
Affects 0.1.3 to 0.1.3. Update sourceAFRICA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 2, 2015Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script CVE-2015-6805 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message.
Product
MDC Private Message
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update MDC Private Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Sep 1, 2015Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitraCVE-2015-2807 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Product
Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud
Fixed in
0.1.1
What to do
Update Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud to 0.1.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 31, 2015Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators toCVE-2015-6535 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
Product
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed
Fixed in
3.3.3
What to do
Update Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 19, 2015Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of adminiCVE-2015-6523 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.
Product
Cross-site request forgery (CSRF) vulnerability in the Portfolio
Fixed in
1.05
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Portfolio to 1.05 or newer.
Full record and what to do →NVD record seclists.org plugins.trac.wordpress.org
Aug 19, 2015SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameteCVE-2015-6522 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.
Product
SQL injection vulnerability in the WP Symposium
Fixed in
15.8
What to do
Update SQL injection vulnerability in the WP Symposium to 15.8 or newer.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Aug 18, 2015Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary loCVE-2015-5482 · WordPress plugins & themes · reported by MITREMedium 4
Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Product
Directory traversal vulnerability in the GD bbPress Attachments
Fixed in
2.3
What to do
Update Directory traversal vulnerability in the GD bbPress Attachments to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com security.dxw.com
Aug 18, 2015Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbCVE-2015-5481 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Product
Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments
Fixed in
2.3
What to do
Update Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 18, 2015Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploCVE-2015-5681 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 18, 2015Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands CVE-2015-5599 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 13, 2015Cross-site scripting (XSS) vulnerability in the qTranslate plugin 2.5.39 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2015-5535 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the qTranslate plugin 2.5.39 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the qtranslate page to wp-admin/options-general.php.
Product
qTranslate
Affected
up to 2.5.39
What to do
Affects up to 2.5.39. Update qTranslate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 13, 2015Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTCVE-2015-2321 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field.
Product
Job Manager
Affected
up to 0.7.22
What to do
Affects up to 0.7.22. Update Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Aug 4, 2015Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrarCVE-2015-3438 · WordPress plugins & themes · reported by security@debian.orgMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.
Fixed in
4.1.2
What to do
Update the plugin to 4.1.2 or newer.
Full record and what to do →NVD record codex.wordpress.org lists.fedoraproject.org
Aug 3, 2015WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and crCVE-2015-5623 · WordPress plugins & themes · reported by MITREMedium 4
WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record codex.wordpress.org openwall.com
Aug 3, 2015WordPress before 4.2.3: Cross-site scripting (XSS)CVE-2015-5622 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.
Product
WordPress before 4.2.3
Fixed in
4.2.3
What to do
Update WordPress before 4.2.3 to 4.2.3 or newer.
Full record and what to do →NVD record codex.wordpress.org openwall.com
Aug 3, 2015wp-includes/wp-db.php in WordPress before 4.2.1: Cross-site scripting (XSS)CVE-2015-3440 · WordPress plugins & themes · reported by security@debian.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
Product
wp-includes/wp-db.php in WordPress before 4.2.1
Fixed in
4.2.1
What to do
Update wp-includes/wp-db.php in WordPress before 4.2.1 to 4.2.1 or newer.
Full record and what to do →NVD record codex.wordpress.org lists.fedoraproject.org
Jul 24, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HCVE-2015-2973 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart
Fixed in
1.4.18
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Welcart to 1.4.18 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jul 8, 2015Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redCVE-2015-5461 · WordPress plugins & themes · reported by MITREMedium 6.4
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Product
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow
Fixed in
5.0.9
What to do
Update Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow to 5.0.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jul 8, 2015Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary CVE-2015-4616 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary files via a .. (dot dot) in the map_id parameter.
Product
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map
Fixed in
1.2.5
What to do
Update Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map to 1.2.5 or newer.
Full record and what to do →NVD record seclists.org securityfocus.com
Jul 8, 2015Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to execute arbitrary SQCVE-2015-4614 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the mapName parameter in an e2m_img_save_map_name action to wp-admin/admin-ajax.php and other unspecified vectors.
Product
Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map
Fixed in
1.2.5
What to do
Update Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map to 1.2.5 or newer.
Full record and what to do →NVD record seclists.org securityfocus.com
Jul 1, 2015Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitraryCVE-2014-1750 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html. NOTE: this was originally reported as a cross-site scripting (XSS) vulnerability, but this may be inaccurate.
Product
Nokia Maps & Places
Affected
1.6.6 to 1.6.6
What to do
Affects 1.6.6 to 1.6.6. Update Nokia Maps & Places to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
Jun 30, 2015Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script CVE-2015-5151 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.
Product
Slider Revolution (revslider)
Affected
4.2.2 to 4.2.2
What to do
Affects 4.2.2 to 4.2.2. Update Slider Revolution (revslider) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 30, 2015The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restricCVE-2014-9735 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
Product
ThemePunch Slider Revolution (revslider)
Affected
up to 1.7.1
Fixed in
3.0.96
What to do
Update ThemePunch Slider Revolution (revslider) to 3.0.96 or newer.
Full record and what to do →NVD record seclists.org securityfocus.com
Jun 30, 2015Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2014-9734 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.
Product
Directory traversal vulnerability in the Slider Revolution (revslider)
Fixed in
4.2
What to do
Update Directory traversal vulnerability in the Slider Revolution (revslider) to 4.2 or newer.
Full record and what to do →NVD record marketblog.envato.com marketblog.envato.com
Jun 18, 2015Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for CVE-2015-4140 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.
Product
WP Smiley
Affected
1.4.1 to 1.4.1
What to do
Affects 1.4.1 to 1.4.1. Update WP Smiley to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Jun 18, 2015Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary webCVE-2015-4139 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php.
Product
WP Smiley
Affected
1.4.1 to 1.4.1
What to do
Affects 1.4.1 to 1.4.1. Update WP Smiley to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Jun 17, 2015Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for WordPress CVE-2015-4414 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Product
SE HTML5 Album Audio Player (se-html5-album-audio-player)
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update SE HTML5 Album Audio Player (se-html5-album-audio-player) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2015Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language fCVE-2015-4338 · WordPress plugins & themes · reported by MITREMedium 6.5
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2015Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via CVE-2015-4337 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual parameter in the xcloner_show page to wpadmin/plugins.php.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2015cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames wCVE-2015-4336 · WordPress plugins & themes · reported by MITREMedium 6.5
cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2015example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2,: Cross-site scripting (XSS)CVE-2015-3429 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
Product
example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2,
Fixed in
3.3.1
What to do
Update example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, to 3.3.1 or newer.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Jun 17, 2015Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to injectCVE-2012-6692 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
Product
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast
Fixed in
2.2
What to do
Update Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast to 2.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 10, 2015Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web scripCVE-2015-4465 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register
Fixed in
1.1.0
What to do
Update Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jun 10, 2015Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary phpCVE-2015-4153 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
Product
Directory traversal vulnerability in the zM Ajax Login & Register
Fixed in
1.1.0
What to do
Update Directory traversal vulnerability in the zM Ajax Login & Register to 1.1.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.