Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
515 results · page 11 of 11
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.CVE-2020-36155 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user meta that defines a user's role. During the registration process, submitted registration details were passed to the update_profile function, and any metadata was accepted, e.g., wp_capabilities[administrator] for Administrator access.
- Product
- An issue was discovered in the Ultimate Member
- Fixed in
- 2.1.12
- What to do
- Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD recordwordpress.orgwpscan.com
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple RCVE-2020-35935 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)
- Product
- Advanced Access Manager
- Fixed in
- 6.6.2
- What to do
- Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
May 28, 2020An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.CVE-2020-13693 · WordPress plugins & themes · reported by MITRECritical 9.8
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
- Product
- An unauthenticated privilege-escalation issue exists in the bbPress
- Fixed in
- 2.6.5
- What to do
- Update An unauthenticated privilege-escalation issue exists in the bbPress to 2.6.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.combbpress.org
Mar 13, 2020The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via adminCVE-2020-10195 · WordPress plugins & themes · reported by MITREMedium 6.3
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.
- Product
- popup-builder
- Fixed in
- 3.64.1
- What to do
- Update popup-builder to 3.64.1 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.CVE-2016-11011 · WordPress plugins & themes · reported by MITREMedium 6.5
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
- Product
- wp-invoice
- Fixed in
- 4.1.1
- What to do
- Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 20, 2019The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.CVE-2016-11004 · WordPress plugins & themes · reported by MITREHigh 8.8
The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.
- Product
- Elegant Themes Monarch
- Fixed in
- 1.2.7
- What to do
- Update Elegant Themes Monarch to 1.2.7 or newer.
Full record and what to do →NVD recordpritect.netwptavern.com
Sep 20, 2019The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.CVE-2016-11003 · WordPress plugins & themes · reported by MITREHigh 8.8
The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.
- Product
- Elegant Themes Bloom
- Fixed in
- 1.1.1
- What to do
- Update Elegant Themes Bloom to 1.1.1 or newer.
Full record and what to do →NVD recordpritect.netwptavern.com
Sep 20, 2019The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.CVE-2016-11002 · WordPress plugins & themes · reported by MITREHigh 8.8
The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.
- Product
- Elegant Themes Extra
- Fixed in
- 1.2.4
- What to do
- Update Elegant Themes Extra to 1.2.4 or newer.
Full record and what to do →NVD recordpritect.netwptavern.com
Sep 20, 2019The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.CVE-2015-9390 · WordPress plugins & themes · reported by MITREMedium 4.3
The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
- Product
- admin-management-xtended
- Fixed in
- 2.4.0.1
- What to do
- Update admin-management-xtended to 2.4.0.1 or newer.
Full record and what to do →NVD recordsecurity.szurek.plwordpress.org
Sep 16, 2019The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.CVE-2016-10968 · WordPress plugins & themes · reported by MITREHigh 8.8
The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.
- Product
- peepso-core
- Fixed in
- 1.6.1
- What to do
- Update peepso-core to 1.6.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Aug 27, 2019The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.CVE-2016-10935 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
- Product
- woocommerce-exporter
- Fixed in
- 1.8.4
- What to do
- Update woocommerce-exporter to 1.8.4 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.CVE-2016-10923 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
- Product
- woocommerce-store-toolkit
- Fixed in
- 1.5.8
- What to do
- Update woocommerce-store-toolkit to 1.5.8 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.CVE-2016-10922 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
- Product
- woocommerce-store-toolkit
- Fixed in
- 1.5.7
- What to do
- Update woocommerce-store-toolkit to 1.5.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.CVE-2018-20979 · WordPress plugins & themes · reported by MITRECritical 9.8
The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.
- Product
- contact-form-7
- Fixed in
- 5.0.4
- What to do
- Update contact-form-7 to 5.0.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.CVE-2019-15111 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
- Product
- wp-front-end-profile
- Fixed in
- 0.2.2
- What to do
- Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.