Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
612 results · page 11 of 13
Sep 20, 2021edit functionality in the MicroCopy: Makes a get request to fetch the related optionCVE-2021-24397 · WordPress plugins & themes · reported by WPScanHigh 7.2
The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- edit functionality in the MicroCopy
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update edit functionality in the MicroCopy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization optionsCVE-2021-24590 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.
- Product
- Cookie Notice & Consent Banner for GDPR & CCPA Compliance
- Fixed in
- 1.7.2
- What to do
- Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to 1.7.2 or newer.
Sep 1, 2021The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file.CVE-2021-39320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
- Product
- underConstruction
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update underConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comwordfence.com
Aug 2, 2021Migrate Users: Does not sanitise or escape its Delimiter option before outputting in a pageCVE-2021-24477 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack.
- Product
- Migrate Users
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Migrate Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Speed Booster Pack ⚡ PageSpeed Optimization Suite: Did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP fileCVE-2021-24430 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE
- Product
- Speed Booster Pack ⚡ PageSpeed Optimization Suite
- Fixed in
- 4.2.0
- What to do
- Update Speed Booster Pack ⚡ PageSpeed Optimization Suite to 4.2.0 or newer.
Jul 12, 2021In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "ShCVE-2021-24454 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.
- Product
- YOP Poll
- Fixed in
- 6.2.8
- What to do
- Update YOP Poll to 6.2.8 or newer.
Full record and what to do →NVD recordwpscan.comin-spired.xyz
Jul 6, 2021In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the userCVE-2021-24388 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However, the field name is not sanitised or escaped before being output back in the page, leading to a stored Cross-Site Scripting issue. There is also no CSRF check done before saving the setting, allowing attackers to make a logged in admin set arbitrary Custom Fields, including one with XSS payload in it.
- Product
- VikRentCar Car Rental Management System
- Fixed in
- 1.1.7
- What to do
- Update VikRentCar Car Rental Management System to 1.1.7 or newer.
Jun 21, 2021Autoptimize: Does not check for malicious files suchCVE-2021-24378 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
- Product
- Autoptimize
- Fixed in
- 2.7.8
- What to do
- Update Autoptimize to 2.7.8 or newer.
Jun 21, 2021Autoptimize: Attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' featureCVE-2021-24377 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
- Product
- Autoptimize
- Fixed in
- 2.7.8
- What to do
- Update Autoptimize to 2.7.8 or newer.
Jun 21, 2021Autoptimize: Attempts to delete malicious files (suchCVE-2021-24376 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.
- Product
- Autoptimize
- Fixed in
- 2.7.8
- What to do
- Update Autoptimize to 2.7.8 or newer.
Jun 21, 2021Jannah: Did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the pageCVE-2021-24364 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
- Product
- Jannah
- Fixed in
- 5.4.4
- What to do
- Update Jannah to 5.4.4 or newer.
Jun 1, 2021Schedule Name" input in the Weekly Schedule: General options did not properly sanitize inputCVE-2021-24309 · WordPress plugins & themes · reported by WPScanMedium 5.4
The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the <script> HTML tags and cause a stored XSS issue
- Product
- Schedule Name" input in the Weekly Schedule
- Fixed in
- 3.4.3
- What to do
- Update Schedule Name" input in the Weekly Schedule to 3.4.3 or newer.
May 24, 2021Autoptimize: Was missing proper escaping and sanitisation in some of its settingsCVE-2021-24332 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
- Product
- Autoptimize
- Fixed in
- 2.8.4
- What to do
- Update Autoptimize to 2.8.4 or newer.
May 5, 2021Contact Form by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24276 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Contact Form by Supsystic
- Fixed in
- 1.7.15
- What to do
- Update Contact Form by Supsystic to 1.7.15 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Popup by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24275 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Popup by Supsystic
- Fixed in
- 1.10.5
- What to do
- Update Popup by Supsystic to 1.10.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Ultimate Maps by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24274 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Ultimate Maps by Supsystic
- Fixed in
- 1.2.5
- What to do
- Update Ultimate Maps by Supsystic to 1.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHPCVE-2016-20010 · WordPress plugins & themes · reported by MITRECritical 10
EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5.
- Fixed in
- 2.8.5
- What to do
- Update the plugin to 2.8.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 12, 2021The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.CVE-2021-24219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapie
- Fixed in
- 1.4.13.3
- What to do
- Update the plugin to 1.4.13.3 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021WP Super Cache: Was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location optionCVE-2021-24209 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
- Product
- WP Super Cache
- Fixed in
- 1.7.2
- What to do
- Update WP Super Cache to 1.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 21, 2020The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS.CVE-2020-35589 · WordPress plugins & themes · reported by MITREMedium 5.4
The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.
- Product
- limit-login-attempts-reloaded
- Fixed in
- 2.17.4
- What to do
- Update limit-login-attempts-reloaded to 2.17.4 or newer.
Full record and what to do →NVD recordn4nj0.github.iowordpress.org
Sep 3, 2020The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege userCVE-2020-24948 · WordPress plugins & themes · reported by MITREHigh 7.2
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
- Fixed in
- 2.7.7
- What to do
- Update the plugin to 2.7.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Aug 16, 2020php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameCVE-2016-11085 · WordPress plugins & themes · reported by MITREMedium 6.5
php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.
- Product
- php/qmn_options_questions_tab.php in the quiz-master-next
- Fixed in
- 4.7.9
- What to do
- Update php/qmn_options_questions_tab.php in the quiz-master-next to 4.7.9 or newer.
Full record and what to do →NVD recordsecurity.dxw.comsecurity.dxw.com
Jun 12, 2020In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved.CVE-2020-4050 · WordPress plugins & themes · reported by GitHubLow 3.5
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- What to do
- Update the plugin to the newest version.
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.CVE-2019-17230 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
- Product
- includes/theme-functions.php in the OneTone
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Feb 24, 2020includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multipleCVE-2019-17229 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.
- Product
- includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads)
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Feb 24, 2020includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unautCVE-2019-17228 · WordPress plugins & themes · reported by MITREMedium 6.5
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
- Product
- includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads)
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation.CVE-2019-19982 · WordPress plugins & themes · reported by MITREMedium 5.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name= request.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Oct 31, 2019plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.CVE-2019-16251 · WordPress plugins & themes · reported by MITREMedium 4.3
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
- Product
- plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpvulndb.com
Oct 22, 2019The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.CVE-2015-9498 · WordPress plugins & themes · reported by MITREHigh 8.8
The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.
- Product
- wps-hide-login
- Fixed in
- 1.1
- What to do
- Update wps-hide-login to 1.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 22, 2019The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.CVE-2015-9497 · WordPress plugins & themes · reported by MITREHigh 8.8
The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.
- Product
- ad-inserter
- Fixed in
- 1.5.3
- What to do
- Update ad-inserter to 1.5.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Oct 10, 2019The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.CVE-2015-9477 · WordPress plugins & themes · reported by MITREHigh 8.8
The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.
- Affected
- 1.2.8 to 1.2.8
- What to do
- Affects 1.2.8 to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Oct 10, 2019The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates.CVE-2015-9476 · WordPress plugins & themes · reported by MITREHigh 8.8
The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates.
- Affected
- 1.8.1 to 1.8.1
- What to do
- Affects 1.8.1 to 1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Oct 10, 2019The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.CVE-2015-9475 · WordPress plugins & themes · reported by MITREHigh 8.8
The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.
- Affected
- 1.5 to 1.5
- What to do
- Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Oct 10, 2019The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.CVE-2015-9474 · WordPress plugins & themes · reported by MITREHigh 8.8
The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.
- Affected
- 1.3.2 to 1.3.2
- What to do
- Affects 1.3.2 to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Oct 10, 2019The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.CVE-2015-9459 · WordPress plugins & themes · reported by MITREMedium 6.1
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
- Product
- searchterms-tagging-2
- Affected
- up to 1.535
- What to do
- Affects up to 1.535. Update searchterms-tagging-2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2019Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.CVE-2019-17232 · WordPress plugins & themes · reported by MITREHigh 7.5
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
- Product
- Functions/EWD_UFAQ_Import.php in the ultimate-faqs
- Affected
- up to 1.8.24
- What to do
- Affects up to 1.8.24. Update Functions/EWD_UFAQ_Import.php in the ultimate-faqs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameCVE-2015-9451 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
- Product
- plugmatter-optin-feature-box-lite
- Fixed in
- 2.0.14
- What to do
- Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.CVE-2015-9450 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
- Product
- plugmatter-optin-feature-box-lite
- Fixed in
- 2.0.14
- What to do
- Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Sep 26, 2019The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.CVE-2015-9443 · WordPress plugins & themes · reported by MITREMedium 6.5
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
- Affected
- 1.2 to 1.2
- What to do
- Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 26, 2019The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.CVE-2015-9441 · WordPress plugins & themes · reported by MITREMedium 6.5
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
- Affected
- 2.9.2 to 2.9.2
- What to do
- Affects 2.9.2 to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 25, 2019The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.CVE-2015-9439 · WordPress plugins & themes · reported by MITREMedium 4.8
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
- Product
- addthis
- Fixed in
- 5.0.13
- What to do
- Update addthis to 5.0.13 or newer.
Full record and what to do →NVD recordblog.cinu.plwordpress.org
Sep 25, 2019The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-CVE-2015-9432 · WordPress plugins & themes · reported by MITREMedium 6.5
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
- Product
- alpine-photo-tile-for-instagram
- Fixed in
- 1.2.7.6
- What to do
- Update alpine-photo-tile-for-instagram to 1.2.7.6 or newer.
Sep 25, 2019The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_CVE-2015-9431 · WordPress plugins & themes · reported by MITREMedium 6.5
The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.
- Product
- qtranslate-x
- Fixed in
- 3.4.4
- What to do
- Update qtranslate-x to 3.4.4 or newer.
Sep 25, 2019The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.CVE-2015-9449 · WordPress plugins & themes · reported by MITREHigh 7.2
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
- Product
- microblog-poster
- Fixed in
- 1.6.2
- What to do
- Update microblog-poster to 1.6.2 or newer.
Sep 25, 2019The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.CVE-2015-9427 · WordPress plugins & themes · reported by MITREMedium 6.5
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
- Product
- googmonify
- Affected
- up to 0.5.1
- What to do
- Affects up to 0.5.1. Update googmonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 25, 2019The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admiCVE-2015-9424 · WordPress plugins & themes · reported by MITREMedium 6.5
The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
- Product
- multicons
- Fixed in
- 3.0
- What to do
- Update multicons to 3.0 or newer.
Sep 25, 2019The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.CVE-2015-9409 · WordPress plugins & themes · reported by MITREMedium 6.5
The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.
- Product
- alo-easymail
- Fixed in
- 2.6.01
- What to do
- Update alo-easymail to 2.6.01 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 20, 2019The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.CVE-2015-9408 · WordPress plugins & themes · reported by MITREMedium 6.5
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
- Product
- xpinner-lite
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update xpinner-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.CVE-2016-11011 · WordPress plugins & themes · reported by MITREMedium 6.5
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
- Product
- wp-invoice
- Fixed in
- 4.1.1
- What to do
- Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 20, 2019The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.CVE-2016-10996 · WordPress plugins & themes · reported by MITREMedium 5.3
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
- Product
- optinmonster
- Fixed in
- 1.1.4.6
- What to do
- Update optinmonster to 1.1.4.6 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.