Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
537 results · page 11 of 11
Jul 7, 2021Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the CVE-2020-24142 · WordPress plugins & themes · reported by MITRECritical 9.8
Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services
- Product
- Video Downloader for TikTok (aka downloader-tiktok)
- Affected
- 1.3 to 1.3
- What to do
- Affects 1.3 to 1.3. Update Video Downloader for TikTok (aka downloader-tiktok) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2021Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerablCVE-2020-24141 · WordPress plugins & themes · reported by MITREMedium 5.3
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
- Product
- WP-DownloadManager
- Affected
- 1.68.4 to 1.68.4
- What to do
- Affects 1.68.4 to 1.68.4. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attributeCVE-2021-24372 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
- Product
- WP Hardening – Fix Your WordPress Security
- Fixed in
- 1.2.2
- What to do
- Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Jun 14, 2021This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server.CVE-2021-24349 · WordPress plugins & themes · reported by WPScanMedium 6.1
This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021LikeBtn WordPress Like Button Rating ♥ LikeBtn: Was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF)CVE-2021-24150 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF).
- Product
- LikeBtn WordPress Like Button Rating ♥ LikeBtn
- Fixed in
- 2.6.32
- What to do
- Update LikeBtn WordPress Like Button Rating ♥ LikeBtn to 2.6.32 or newer.
Feb 7, 2021wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.CVE-2021-26754 · WordPress plugins & themes · reported by MITRECritical 9.8
wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.
- Fixed in
- 3.4.1
- What to do
- Update the plugin to 3.4.1 or newer.
Full record and what to do →NVD recordn4nj0.github.iowordpress.org
Dec 25, 2020A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.CVE-2020-29172 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.
- Product
- A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache
- Fixed in
- 3.6.1
- What to do
- Update A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache to 3.6.1 or newer.
Full record and what to do →NVD recordwordpress.orglitespeedtech.com
Nov 2, 2020wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.CVE-2020-28036 · WordPress plugins & themes · reported by MITRECritical 9.8
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 8, 2020Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions CreaCVE-2014-8739 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
- Fixed in
- 1.0.0
- What to do
- Update the plugin to 1.0.0 or newer.
Oct 17, 2019WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.CVE-2019-17670 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD recordblog.wpscan.orgcore.trac.wordpress.org
Oct 17, 2019WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series CVE-2019-17669 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD recordblog.wpscan.orgcore.trac.wordpress.org
Sep 15, 2019In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possiCVE-2019-16332 · WordPress plugins & themes · reported by MITREMedium 6.1
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
- Product
- api-bearer-auth
- Fixed in
- 20190907
- What to do
- Update api-bearer-auth to 20190907 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Aug 20, 2019The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.CVE-2016-10914 · WordPress plugins & themes · reported by MITREHigh 8.8
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
- Product
- add-from-server
- Fixed in
- 3.3.2
- What to do
- Update add-from-server to 3.3.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jul 3, 2019A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQCVE-2019-12570 · WordPress plugins & themes · reported by MITREHigh 8.8
A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters.
- Product
- Xpert Solution "Server Status by Hostname/IP
- Affected
- 4.6 to 4.6
- What to do
- Affects 4.6 to 4.6. Update Xpert Solution "Server Status by Hostname/IP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwpvulndb.com
May 7, 2019The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files,CVE-2018-19456 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files, as demonstrated by download.sql.
- Product
- WP Backup+ (aka WPbackupplus)
- Affected
- up to 2018-11-22
- What to do
- Affects up to 2018-11-22. Update WP Backup+ (aka WPbackupplus) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.opensuse.orgeasyhack.in
Apr 27, 2019Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.CVE-2019-11565 · WordPress plugins & themes · reported by MITRECritical 9.8
Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.
- Product
- Server Side Request Forgery (SSRF) exists in the Print My Blog
- Fixed in
- 1.6.7
- What to do
- Update Server Side Request Forgery (SSRF) exists in the Print My Blog to 1.6.7 or newer.
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictiCVE-2018-20149 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
- Fixed in
- 4.9.9
- What to do
- Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD recordsecurityfocus.comcodex.wordpress.org
Apr 16, 2018Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.CVE-2018-10101 · WordPress plugins & themes · reported by MITREMedium 6.1
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 9, 2018The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.CVE-2018-5316 · WordPress plugins & themes · reported by MITREMedium 6.1
The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.
- Product
- SagePay Server Gateway for WooCommerce
- Fixed in
- 1.0.9
- What to do
- Update SagePay Server Gateway for WooCommerce to 1.0.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 14, 2017Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php dCVE-2017-1002000 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content.
- Affected
- 3.0 to 3.0
- What to do
- Affects 3.0 to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jan 14, 2017wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com nCVE-2017-5491 · WordPress plugins & themes · reported by MITREMedium 5.3
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
- Fixed in
- 4.7.1
- What to do
- Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD recorddebian.orgopenwall.com
Oct 10, 2016Reflected XSS in wordpress plugin simpel-reserveren v3.5.2CVE-2016-1000149 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin simpel-reserveren v3.5.2
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
May 21, 2016The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attackCVE-2016-2222 · WordPress plugins & themes · reported by security@debian.orgHigh 8.6
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
- Fixed in
- 4.4.2
- What to do
- Update the plugin to 4.4.2 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
May 21, 2016The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypassCVE-2015-5715 · WordPress plugins & themes · reported by MITREMedium 4.3
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
- Fixed in
- 4.3.1
- What to do
- Update the plugin to 4.3.1 or newer.
Dec 5, 2014Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbounCVE-2014-9292 · WordPress plugins & themes · reported by MITREMedium 5.8
Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbound requests and enumerate open ports via the url parameter.
- Product
- jRSS Widget
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update jRSS Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Dec 1, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Server-side request forgery (SSRF)CVE-2014-8749 · WordPress plugins & themes · reported by MITREMedium 5
Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.
- Product
- admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
- Affected
- up to .51
- What to do
- Affects up to .51. Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseclists.orgwordpress.org
Nov 25, 2014wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side requCVE-2014-9038 · WordPress plugins & themes · reported by MITREMedium 6.4
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.
- Fixed in
- 3.7.5
- What to do
- Update the plugin to 3.7.5 or newer.
Full record and what to do →NVD recordadvisories.mageia.orgopenwall.com
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow reCVE-2014-4513 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter.
- Product
- ActiveHelper LiveHelp Live Chat
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update ActiveHelper LiveHelp Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jan 16, 2014SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbiCVE-2012-6625 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action.
- Product
- SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server
- Fixed in
- 1.7.4
- What to do
- Update SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server to 1.7.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.orgwordpress.org
Jan 16, 2014Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackeCVE-2012-6623 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php.
- Product
- Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server
- Fixed in
- 1.7.5
- What to do
- Update Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server to 1.7.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote atCVE-2012-6622 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server
- Fixed in
- 1.7.4
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server to 1.7.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Jul 8, 2013The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side RequeCVE-2013-2199 · WordPress plugins & themes · reported by Red HatMedium 4.3
The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.
- Fixed in
- 3.5.2
- What to do
- Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgwordpress.org
Jul 8, 2013The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a cCVE-2013-0235 · WordPress plugins & themes · reported by Red HatMedium 6.4
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
- Fixed in
- 3.5.1
- What to do
- Update the plugin to 3.5.1 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Sep 14, 2012The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticateCVE-2012-4421 · WordPress plugins & themes · reported by Red HatMedium 4
The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.
- Fixed in
- 3.4.2
- What to do
- Update the plugin to 3.4.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Feb 21, 2011Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrarCVE-2011-1047 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.
- What to do
- Update the plugin to the newest version.
Oct 20, 2008The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.CVE-2008-4616 · WordPress plugins & themes · reported by MITREMedium 5
The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Jul 5, 2005XMLRPC server in WordPress 1.5.1.2 and earlier: SQL injectionCVE-2005-2108 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTP_RAW_POST_DATA variable, which stores the data in an XML file.
- Product
- XMLRPC server in WordPress 1.5.1.2 and earlier
- Affected
- up to 1.5.1.2
- What to do
- Affects up to 1.5.1.2. Update XMLRPC server in WordPress 1.5.1.2 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.