Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

570 results · page 11 of 12

Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0993 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
Product
SiteGround Security
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0992 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
Product
SiteGround Security
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 9, 2021simpleSAMLphp Authentication: Reflected Cross-Site ScriptingCVE-2021-38320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.0.
Product
simpleSAMLphp Authentication
Affected
up to 0.7.0
What to do
Affects up to 0.7.0. Update simpleSAMLphp Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 6, 2021Email Encoder – Protect Email Addresses: Has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the dataCVE-2021-24599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.
Product
Email Encoder – Protect Email Addresses
Fixed in
2.1.2
What to do
Update Email Encoder – Protect Email Addresses to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verificationCVE-2021-34646 · WordPress plugins & themes · reported by WordfenceCritical 9.8
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.
Product
Booster for WooCommerce
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 6, 2021Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPCVE-2021-24375 · WordPress plugins & themes · reported by WPScanCritical 9.8
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.
Product
Motor
Fixed in
3.1.0
What to do
Update Motor to 3.1.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 5, 2021Plus Addons for Elementor Page Builder: Was being actively exploited to by malicious actors to bypass authenticationCVE-2021-24175 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
Product
Plus Addons for Elementor Page Builder
Fixed in
4.1.7
What to do
Update Plus Addons for Elementor Page Builder to 4.1.7 or newer.
Full record and what to do →NVD record posimyth.ticksy.com wpscan.com
Mar 18, 2021A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated CVE-2021-24148 · WordPress plugins & themes · reported by WPScanCritical 9.8
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
Product
MStore API
Fixed in
3.2.0
What to do
Update MStore API to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 10, 2020Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticCVE-2020-5780 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.3
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.
Fixed in
4.5.6
What to do
Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Feb 6, 2020The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass.CVE-2020-8771 · WordPress plugins & themes · reported by MITRECritical 9.8
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
Product
Time Capsule
Fixed in
1.21.16
What to do
Update Time Capsule to 1.21.16 or newer.
Full record and what to do →NVD record wpvulndb.com webarxsecurity.com
Jan 28, 2020Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication ofCVE-2015-5483 · WordPress plugins & themes · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.
Product
Private Only
Affected
3.5.1 to 3.5.1
What to do
Affects 3.5.1 to 3.5.1. Update Private Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 27, 2020WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerabilityCVE-2013-4462 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 8, 2020A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user infoCVE-2019-20360 · WordPress plugins & themes · reported by MITREHigh 7.5
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.
Fixed in
2.5.5
What to do
Update the plugin to 2.5.5 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Sep 17, 2019The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.CVE-2016-10976 · WordPress plugins & themes · reported by MITREMedium 6.1
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
Product
safe-editor
Fixed in
1.2
What to do
Update safe-editor to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.CVE-2019-15820 · WordPress plugins & themes · reported by MITREMedium 6.1
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
Product
login-or-logout-menu-item
Fixed in
1.2.0
What to do
Update login-or-logout-menu-item to 1.2.0 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15819 · WordPress plugins & themes · reported by MITRECritical 9.8
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Product
nd-restaurant-reservations
Fixed in
1.5
What to do
Update nd-restaurant-reservations to 1.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301CVE-2019-15818 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
Product
simple-301-redirects-addon-bulk-uploader
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update simple-301-redirects-addon-bulk-uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 28, 2019The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.CVE-2015-9355 · WordPress plugins & themes · reported by MITREMedium 6.1
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Product
two-factor-authentication
Fixed in
1.1.10
What to do
Update two-factor-authentication to 1.1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.CVE-2014-10389 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 5, 2019An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings.CVE-2019-13344 · WordPress plugins & themes · reported by MITREMedium 5.3
An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter.
Product
An authentication bypass vulnerability in the CRUDLab WP Like Button
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update An authentication bypass vulnerability in the CRUDLab WP Like Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com limbenjamin.com
Dec 19, 2018Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_CVE-2018-20231 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.
Product
Cross Site Request Forgery (CSRF) in the two-factor-authentication
Fixed in
1.3.13
What to do
Update Cross Site Request Forgery (CSRF) in the two-factor-authentication to 1.3.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Apr 6, 2018Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication CVE-2014-5072 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log
Fixed in
1.2.5
What to do
Update Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log to 1.2.5 or newer.
Full record and what to do →NVD record github.com wpsecurityauditlog.com
Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication oCVE-2014-2550 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php.
Product
Cross-site request forgery (CSRF) vulnerability in the Disable Comments
Fixed in
1.0.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Disable Comments to 1.0.4 or newer.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com security.dxw.com
Jan 1, 2018Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrarCVE-2018-3810 · WordPress plugins & themes · reported by MITRECritical 9.8
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.
Product
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter
Fixed in
3.5
What to do
Update Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter to 3.5 or newer.
Full record and what to do →NVD record limbenjamin.com wordpress.org
Nov 9, 2017The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain admCVE-2017-16562 · WordPress plugins & themes · reported by MITRECritical 9.8
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
Product
UserPro
Fixed in
4.9.17.1
What to do
Update UserPro to 4.9.17.1 or newer.
Full record and what to do →NVD record codecanyon.net wpvulndb.com
Sep 27, 2017The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_deCVE-2017-14766 · WordPress plugins & themes · reported by MITREHigh 7.5
The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_del_st_submit() function in functions.php only require knowing the student id number.
Product
Simple Student Result
Fixed in
1.6.4
What to do
Update Simple Student Result to 1.6.4 or newer.
Full record and what to do →NVD record limbenjamin.com wordpress.org
Aug 19, 2015Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of adminiCVE-2015-6523 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.
Product
Cross-site request forgery (CSRF) vulnerability in the Portfolio
Fixed in
1.05
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Portfolio to 1.05 or newer.
Full record and what to do →NVD record seclists.org plugins.trac.wordpress.org
Jun 18, 2015Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for CVE-2015-4140 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.
Product
WP Smiley
Affected
1.4.1 to 1.4.1
What to do
Affects 1.4.1 to 1.4.1. Update WP Smiley to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Feb 25, 2015Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication CVE-2015-2084 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit action in the cnss_social_icon_add page to wp-admin/admin.php.
Product
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons
Fixed in
1.2.3
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons to 1.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Feb 11, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication oCVE-2015-1581 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php.
Product
Mobile Domain
Affected
1.5.2 to 1.5.2
What to do
Affects 1.5.2 to 1.5.2. Update Mobile Domain to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Feb 11, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication CVE-2015-1580 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) source or (3) redir parameter in an add action in the redirection-page to wp-admin/options-general.php.
Product
Redirection Page
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update Redirection Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jan 15, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of adCVE-2014-7957 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the toggled parameter in a toggle action in the pods-components page to wp-admin/admin.php, (2) delete a pod in a delete action in the pods page to wp-admin/admin.php, (3) reset pod settings and data via the pods_reset parameter in the pod-settings page to wp-admin/admin.php, (4) deactivate and reset pod data via the pods_reset_deactivate parameter in the pod-settings page to wp-admin/admin.php, (5) delete the admin role via the id parameter in a delete action in the pods-component-roles-and-capabilities page to wp-admin/admin.php, or (6) enable "roles and capabilities" in a toggle action in the pods-components page to wp-admin/admin.php.
Product
Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods
Fixed in
2.5
What to do
Update Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods to 2.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 12, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication CVE-2014-2838 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct (1) SQL injection attacks via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php or (2) cross-site scripting (XSS) attacks via unspecified vectors.
Product
GD Star Rating
Affected
19.22 to 19.22
What to do
Affects 19.22 to 19.22. Update GD Star Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org secunia.com
Jan 8, 2015Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of aCVE-2015-0920 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the BannerEffectOptions page to wp-admin/options-general.php.
Product
Banner Effect Header
Affected
1.2.6 to 1.2.6
What to do
Affects 1.2.6 to 1.2.6. Update Banner Effect Header to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Dec 31, 2014Cross-site request forgery (CSRF) vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack the authentication of CVE-2014-9399 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the tweetscribe_username parameter in a save action in the tweetscribe.php page to wp-admin/options-general.php.
Product
TweetScribe
Affected
up to 1.1
What to do
Affects up to 1.1. Update TweetScribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 24, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of CVE-2014-9334 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) user or (2) password parameter in the bird-feeder page to wp-admin/options-general.php.
Product
Bird Feeder
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update Bird Feeder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 19, 2014Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of CVE-2014-9368 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the username_twitterDash parameter in the twitterDash.php page to wp-admin/options-general.php.
Product
twitterDash
Affected
up to 2.1
What to do
Affects up to 2.1. Update twitterDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Nov 26, 2014Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of adminiCVE-2014-9099 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydowork_adsense page in wp-admin/options-general.php.
Product
WhyDoWork AdSense
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update WhyDoWork AdSense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 27, 2014The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code CVE-2014-4725 · WordPress plugins & themes · reported by MITREHigh 7.5
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.
Product
MailPoet Newsletters (wysija-newsletters)
Fixed in
2.6.7
What to do
Update MailPoet Newsletters (wysija-newsletters) to 2.6.7 or newer.
Full record and what to do →NVD record arstechnica.com blog.sucuri.net
Jun 25, 2014Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of adminCVE-2014-4030 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php.
Product
Cross-site request forgery (CSRF) vulnerability in the JW Player
Fixed in
2.1.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the JW Player to 2.1.4 or newer.
Full record and what to do →NVD record seclists.org secunia.com
Jun 25, 2014Cross-site request forgery (CSRF) vulnerability in the Login rebuilder plugin before 1.2.0 for WordPress allows remote attackers to hijack the authentication ofCVE-2014-3882 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Login rebuilder plugin before 1.2.0 for WordPress allows remote attackers to hijack the authentication of arbitrary users.
Product
Cross-site request forgery (CSRF) vulnerability in the Login rebuilder
Fixed in
1.2.0
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Login rebuilder to 1.2.0 or newer.
Full record and what to do →NVD record 12net.jp jvn.jp
Jun 11, 2014Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of adminCVE-2014-3850 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to wp-admin/options-general.php.
Product
Member Approval
Affected
131109 to 131109
What to do
Affects 131109 to 131109. Update Member Approval to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org security.dxw.com
Jun 2, 2014Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the authentication of users CVE-2013-3258 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in he Digg Digg
Fixed in
5.3.5
What to do
Update Cross-site request forgery (CSRF) vulnerability in he Digg Digg to 5.3.5 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jun 2, 2014Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of uCVE-2013-3257 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Related Posts
Fixed in
2.7.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Related Posts to 2.7.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 27, 2014Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users CVE-2013-2698 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Calendar
Fixed in
1.3.3
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Calendar to 1.3.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 22, 2014Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of CVE-2013-2107 · WordPress plugins & themes · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php. NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable, but the issue might require a separate CVE identifier since this might reflect an incomplete fix.
Product
Cross-site request forgery (CSRF) vulnerability in the Mail On Update
Fixed in
5.2.0
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Mail On Update to 5.2.0 or newer.
Full record and what to do →NVD record osvdb.org seclists.org
May 22, 2014Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authenticationCVE-2014-3845 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors. NOTE: some of these details are obtained from third party information.
Product
Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker
Fixed in
1.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker to 1.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 22, 2014Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication CVE-2014-3843 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Search Everything
Fixed in
8.1.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Search Everything to 8.1.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 25, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administCVE-2014-2579 · WordPress plugins & themes · reported by MITREHigh 7.6
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands.
Product
generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner
Affected
up to 3.5
What to do
Affects up to 3.5. Update generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Apr 11, 2014Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authentication of administCVE-2013-2708 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Product
Content Slide
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update Content Slide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.