Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

563new WordPress flaws this week

392,577entries in the database

5,703 results · page 110 of 115

Oct 14, 2020Live Chat - Live support version 3.1.0 and earlier: Cross-site request forgery (CSRF)CVE-2020-5642 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Live Chat - Live support version 3.1.0 and earlier
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Live Chat - Live support version 3.1.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jul 27, 2020Social Sharing Plugin versions prior to 1.2.10: Cross-site request forgery (CSRF)CVE-2020-5611 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Social Sharing Plugin versions prior to 1.2.10
Fixed in
1.2.10
What to do
Update Social Sharing Plugin versions prior to 1.2.10 to 1.2.10 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 17, 2020Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legCVE-2020-5767 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.5
Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link.
Affected
4.4.8 to 4.4.8
What to do
Affects 4.4.8 to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Jun 22, 2020the forms it presents, allowing the possibility of deleting records: The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF)CVE-2020-13426 · WordPress plugins & themes · reported by MITREMedium 6.5
The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.
Product
the forms it presents, allowing the possibility of deleting records
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the forms it presents, allowing the possibility of deleting records to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record 0day.today cxsecurity.com
Jun 19, 2020WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSSCVE-2019-20891 · WordPress plugins & themes · reported by MITREHigh 8.8
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.
Fixed in
3.6.5
What to do
Update the plugin to 3.6.5 or newer.
Full record and what to do →NVD record blog.ripstech.com raw.githubusercontent.com
Apr 24, 2020The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request viaCVE-2020-12070 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.
Product
Advanced Woo Search
Affected
up to 1.99
What to do
Affects up to 1.99. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 22, 2020The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.CVE-2020-12073 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.
Product
responsive-add-ons
Fixed in
2.2.7
What to do
Update responsive-add-ons to 2.2.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 1, 2020Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.CVE-2020-5391 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.
Product
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0
Fixed in
4.0.0
What to do
Update Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com github.com
Mar 6, 2020A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator tCVE-2020-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
Product
A CSRF vulnerability in the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update A CSRF vulnerability in the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 18, 2020Easy Property Listings versions prior to 3.4: Cross-site request forgery (CSRF)CVE-2020-5530 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Easy Property Listings versions prior to 3.4
Fixed in
3.4
What to do
Update Easy Property Listings versions prior to 3.4 to 3.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Feb 6, 2020The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.CVE-2020-8772 · WordPress plugins & themes · reported by MITRECritical 9.8
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.
Product
InfiniteWP Client
Fixed in
1.9.4.5
What to do
Update InfiniteWP Client to 1.9.4.5 or newer.
Full record and what to do →NVD record wpvulndb.com webarxsecurity.com
Jan 28, 2020Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication ofCVE-2015-5483 · WordPress plugins & themes · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.
Product
Private Only
Affected
3.5.1 to 3.5.1
What to do
Affects 3.5.1 to 3.5.1. Update Private Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 26, 2019Custom Body Class 0.6.0 and earlier: Cross-site request forgery (CSRF)CVE-2019-6030 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Custom Body Class 0.6.0 and earlier
Affected
up to 0.6.0
What to do
Affects up to 0.6.0. Update Custom Body Class 0.6.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 26, 2019WP Spell Check 7.1.9 and earlier: Cross-site request forgery (CSRF)CVE-2019-6027 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WP Spell Check 7.1.9 and earlier
Affected
up to 7.1.9
What to do
Affects up to 7.1.9. Update WP Spell Check 7.1.9 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 4, 2019The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanCVE-2019-19133 · WordPress plugins & themes · reported by MITREMedium 6.1
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.
Product
CSS Hero
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update CSS Hero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 17, 2019WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.CVE-2019-17673 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org core.trac.wordpress.org
Oct 17, 2019WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.CVE-2019-17670 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org core.trac.wordpress.org
Oct 17, 2019WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series CVE-2019-17669 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org core.trac.wordpress.org
Oct 10, 2019The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1CVE-2015-9479 · WordPress plugins & themes · reported by MITRECritical 9.8
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
Product
ACF-Frontend-Display
Affected
up to 2015-07-03
What to do
Affects up to 2015-07-03. Update ACF-Frontend-Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 16, 2019The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.CVE-2016-10971 · WordPress plugins & themes · reported by MITRECritical 9.8
The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
Product
MemberSonic Lite
Fixed in
1.302
What to do
Update MemberSonic Lite to 1.302 or newer.
Full record and what to do →NVD record pritect.net pritect.net
Sep 12, 2019WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier: Cross-site request forgery (CSRF)CVE-2019-5992 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier
Affected
up to 4.4
What to do
Affects up to 4.4. Update WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp jvn.jp
Sep 10, 2019The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.CVE-2017-18604 · WordPress plugins & themes · reported by MITREHigh 7.5
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
Product
sitebuilder-dynamic-components
Affected
up to 1.0
What to do
Affects up to 1.0. Update sitebuilder-dynamic-components to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with theCVE-2019-15873 · WordPress plugins & themes · reported by MITREHigh 8.8
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.
Product
profilegrid-user-profiles-groups-and-communities
Fixed in
2.8.6
What to do
Update profilegrid-user-profiles-groups-and-communities to 2.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.CVE-2019-15863 · WordPress plugins & themes · reported by MITREHigh 7.5
The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
Product
ConvertPlus
Fixed in
3.4.5
What to do
Update ConvertPlus to 3.4.5 or newer.
Full record and what to do →NVD record convertplug.com convertplug.com
Aug 30, 2019The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.CVE-2019-15820 · WordPress plugins & themes · reported by MITREMedium 6.1
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
Product
login-or-logout-menu-item
Fixed in
1.2.0
What to do
Update login-or-logout-menu-item to 1.2.0 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15819 · WordPress plugins & themes · reported by MITRECritical 9.8
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Product
nd-restaurant-reservations
Fixed in
1.5
What to do
Update nd-restaurant-reservations to 1.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301CVE-2019-15818 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
Product
simple-301-redirects-addon-bulk-uploader
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update simple-301-redirects-addon-bulk-uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.CVE-2014-10385 · WordPress plugins & themes · reported by MITREMedium 6.1
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · WordPress plugins & themes · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
Product
ninja-forms
Fixed in
3.3.9
What to do
Update ninja-forms to 3.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.CVE-2016-10895 · WordPress plugins & themes · reported by MITREMedium 6.1
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
Product
option-tree
Fixed in
2.6.0
What to do
Update option-tree to 2.6.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.CVE-2016-10893 · WordPress plugins & themes · reported by MITREMedium 6.1
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
Product
crayon-syntax-highlighter
Fixed in
2.8.4
What to do
Update crayon-syntax-highlighter to 2.8.4 or newer.
Full record and what to do →NVD record github.com github.com
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Product
wp-all-import
Fixed in
3.2.4
What to do
Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameterCVE-2015-9316 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Product
wp-fastest-cache
Fixed in
0.8.4.9
What to do
Update wp-fastest-cache to 0.8.4.9 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.CVE-2015-9293 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.8
What to do
Update all-in-one-wp-security-and-firewall to 3.9.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated byCVE-2016-10865 · WordPress plugins & themes · reported by MITREMedium 6.1
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
Product
Lightbox Plus Colorbox
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Lightbox Plus Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Jul 5, 2019Custom CSS Pro 1.0.3 and earlier: Cross-site request forgery (CSRF)CVE-2019-5984 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Custom CSS Pro 1.0.3 and earlier
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Custom CSS Pro 1.0.3 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 5, 2019HTML5 Maps 1.6.5.6 and earlier: Cross-site request forgery (CSRF)CVE-2019-5983 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in HTML5 Maps 1.6.5.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
HTML5 Maps 1.6.5.6 and earlier
Affected
up to 1.6.5.6
What to do
Affects up to 1.6.5.6. Update HTML5 Maps 1.6.5.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 5, 2019Related YouTube Videos versions prior to 1.9.9: Cross-site request forgery (CSRF)CVE-2019-5980 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Related YouTube Videos versions prior to 1.9.9
Fixed in
1.9.9
What to do
Update Related YouTube Videos versions prior to 1.9.9 to 1.9.9 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 5, 2019Personalized WooCommerce Cart Page 2.4 and earlier: Cross-site request forgery (CSRF)CVE-2019-5979 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Personalized WooCommerce Cart Page 2.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Personalized WooCommerce Cart Page 2.4 and earlier
Affected
up to 2.4
What to do
Affects up to 2.4. Update Personalized WooCommerce Cart Page 2.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 5, 2019Contest Gallery versions prior to 10.4.5: Cross-site request forgery (CSRF)CVE-2019-5974 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Contest Gallery versions prior to 10.4.5
Fixed in
10.4.5
What to do
Update Contest Gallery versions prior to 10.4.5 to 10.4.5 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 5, 2019Online Lesson Booking 0.8.6 and earlier: Cross-site request forgery (CSRF)CVE-2019-5973 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Online Lesson Booking 0.8.6 and earlier
Affected
up to 0.8.6
What to do
Affects up to 0.8.6. Update Online Lesson Booking 0.8.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp olbsys.com
Jul 5, 2019Attendance Manager 0.5.6 and earlier: Cross-site request forgery (CSRF)CVE-2019-5971 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Attendance Manager 0.5.6 and earlier
Affected
up to 0.5.6
What to do
Affects up to 0.5.6. Update Attendance Manager 0.5.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record attmgr.com jvn.jp
Jul 5, 2019Zoho SalesIQ 1.0.8 and earlier: Cross-site request forgery (CSRF)CVE-2019-5963 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Zoho SalesIQ 1.0.8 and earlier
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Zoho SalesIQ 1.0.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 1, 2019A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers toCVE-2019-12826 · WordPress plugins & themes · reported by MITREHigh 8.8
A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to dynamically determine their visibility) by crafting a malicious POST request that tricks administrators into adding the code.
Product
A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic
Fixed in
5.10.2
What to do
Update A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic to 5.10.2 or newer.
Full record and what to do →NVD record dannewitz.ninja plugins.trac.wordpress.org
May 20, 2019The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrativCVE-2019-12239 · WordPress plugins & themes · reported by MITREHigh 7.2
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
Fixed in
1.5.2
What to do
Update the plugin to 1.5.2 or newer.
Full record and what to do →NVD record dumpco.re wordpress.org
May 9, 2019The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (itCVE-2019-11869 · WordPress plugins & themes · reported by MITREMedium 6.1
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.
Affected
5.12.94 to 5.12.94
What to do
Affects 5.12.94 to 5.12.94. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Apr 27, 2019Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.CVE-2019-11565 · WordPress plugins & themes · reported by MITRECritical 9.8
Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.
Product
Server Side Request Forgery (SSRF) exists in the Print My Blog
Fixed in
1.6.7
What to do
Update Server Side Request Forgery (SSRF) exists in the Print My Blog to 1.6.7 or newer.
Full record and what to do →NVD record dumpco.re github.com
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, whicCVE-2018-19488 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account.
Product
WP-jobhunt
Fixed in
2.4
What to do
Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.phpCVE-2018-19487 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.
Product
WP-jobhunt
Fixed in
2.4
What to do
Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Mar 12, 2019Smart Forms 2.6.15 and earlier: Cross-site request forgery (CSRF)CVE-2019-5924 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.
Product
Smart Forms 2.6.15 and earlier
Affected
up to 2.6.15
What to do
Affects up to 2.6.15. Update Smart Forms 2.6.15 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.