Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

562new WordPress flaws this week

392,577entries in the database

5,771 results · page 111 of 116

Mar 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settiCVE-2014-2040 · WordPress plugins & themes · reported by MITRELow 2.1
Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file.
Product
Media File Renamer
Affected
1.7.0 to 1.7.0
What to do
Affects 1.7.0 to 1.7.0. Update Media File Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Mar 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inCVE-2013-3487 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified HTML header fields to (1) 400.php, (2) 403.php, or (3) 403.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record osvdb.org osvdb.org
Mar 3, 2014Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2013-1409 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the CommentLuv
Fixed in
2.92.4
What to do
Update Cross-site scripting (XSS) vulnerability in the CommentLuv to 2.92.4 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Feb 28, 2014Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script orCVE-2014-1888 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
Product
Cross-site scripting (XSS) vulnerability in the BuddyPress
Fixed in
1.9.2
What to do
Update Cross-site scripting (XSS) vulnerability in the BuddyPress to 1.9.2 or newer.
Full record and what to do →NVD record buddypress.org osvdb.org
Feb 27, 2014SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress alCVE-2014-1854 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com adrotateplugin.com
Feb 6, 2014Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2013-7319 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field.
Product
Cross-site scripting (XSS) vulnerability in the Download Manager
Fixed in
2.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in the Download Manager to 2.5.9 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Feb 5, 2014SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commandCVE-2013-1852 · WordPress plugins & themes · reported by Red HatHigh 7.5
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
Product
SQL injection vulnerability in leaguemanager.php in the LeagueManager
Fixed in
3.8.1
What to do
Update SQL injection vulnerability in leaguemanager.php in the LeagueManager to 3.8.1 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 20, 2014wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML: Cross-site scripting (XSS)CVE-2010-5295 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.
Product
wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML
Fixed in
3.0.2
What to do
Update wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web scCVE-2012-6630 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) bulk parameter to media-library-categories/add.php or (2) q parameter to media-library-categories/view.php.
Product
Media Library Categories
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update Media Library Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack theCVE-2012-6629 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com secunia.com
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web sCVE-2012-6628 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php, (3) xyz_em_email parameter to admin/edit_email.php, (4) xyz_em_exportbatchSize parameter to import_export.php, or (5) pagination limit in the Newsletter Manager options.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager
Fixed in
1.0.2
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager to 1.0.2 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to injeCVE-2012-6627 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbiCVE-2012-6625 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action.
Product
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server
Fixed in
1.7.4
What to do
Update SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server to 1.7.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org wordpress.org
Jan 16, 2014Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2012-6624 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloud_is_gold_player_preview action to wp-admin/admin-ajax.php.
Product
SoundCloud Is Gold
Affected
2.1 to 2.1
What to do
Affects 2.1 to 2.1. Update SoundCloud Is Gold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackeCVE-2012-6623 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server
Fixed in
1.7.5
What to do
Update Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server to 1.7.5 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote atCVE-2012-6622 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action.
Product
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server
Fixed in
1.7.4
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server to 1.7.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 8, 2014Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script orCVE-2014-1232 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG
Fixed in
2.6.8.5
What to do
Update Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG to 2.6.8.5 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jan 8, 2014Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers tCVE-2013-7279 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter.
Product
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video
Fixed in
0.983
What to do
Update Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video to 0.983 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jan 8, 2014Cross-site scripting (XSS) vulnerability in inc/raf_form.php in the Recommend to a friend plugin 2.0.2 for WordPress allows remote attackers to inject arbitraryCVE-2013-7276 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in inc/raf_form.php in the Recommend to a friend plugin 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the current_url parameter.
Product
Recommend to a friend
What to do
Update Recommend to a friend to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 3, 2014Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a CVE-2013-7240 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.
Product
Advanced Dewplayer
What to do
Update Advanced Dewplayer to the newest version.
Full record and what to do →NVD record seclists.org seclists.org
Jan 3, 2014Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML CVE-2013-6993 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php.
Product
Ad-minister
Affected
up to 0.6
What to do
Affects up to 0.6. Update Ad-minister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org securityfocus.com
Jan 3, 2014Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows reCVE-2013-6992 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the aafireadcode parameter to wp-admin/options-general.php.
Product
AskApache Firefox Adsense
Affected
up to 3.0
What to do
Affects up to 3.0. Update AskApache Firefox Adsense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org securityfocus.com
Jan 3, 2014Cross-site scripting (XSS) vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script CVE-2013-6991 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php.
Product
WP-Cron Dashboard
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update WP-Cron Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org securityfocus.com
Dec 20, 2013SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via thCVE-2013-7187 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
FormCraft
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Nov 22, 2013Cross-site scripting (XSS) vulnerability in the Tweet Blender plugin before 4.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2013-6342 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Tweet Blender plugin before 4.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tb_tab_index parameter to wp-admin/options-general.php.
Product
Cross-site scripting (XSS) vulnerability in the Tweet Blender
Fixed in
4.0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Tweet Blender to 4.0.2 or newer.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Nov 18, 2013Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote aCVE-2013-6797 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw_url parameter in the bw-videos page to wp-admin/admin.php, as demonstrated by embedding a URL to a JavaScript file.
Product
Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget
Fixed in
2.0.0
What to do
Update Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget to 2.0.0 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Nov 5, 2013The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaCVE-2013-3264 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.4
The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaign.php, which allows remote attackers to modify list or campaign data.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Nov 5, 2013Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to CVE-2013-3263 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid, (11) campaignname, (12) campaignsubject, or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid, (15) campaignname, (16) campaignformat, or (17) action parameter to campaign/updatecampaign.php.
Product
WP Ultimate Email Marketer
What to do
Update WP Ultimate Email Marketer to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Nov 1, 2013Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack tCVE-2013-5977 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.
Product
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite
Fixed in
1.5.1.15
What to do
Update Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite to 1.5.1.15 or newer.
Full record and what to do →NVD record archives.neohapsis.com blog.noobroot.com
Nov 1, 2013Cross-site request forgery (CSRF) vulnerability in the Social Sharing Toolkit plugin 2.1.1 for WordPress allows remote attackers to hijack the authentication ofCVE-2013-2701 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Social Sharing Toolkit plugin 2.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings via unknown vectors.
Product
Social Sharing Toolkit
Affected
2.1.1 to 2.1.1
What to do
Affects 2.1.1 to 2.1.1. Update Social Sharing Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com securityfocus.com
Oct 25, 2013Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows remote attackers to CVE-2013-6281 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "page" parameter.
Product
Spreadsheet (dhtmlxSpreadsheet)
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update Spreadsheet (dhtmlxSpreadsheet) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Oct 25, 2013Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2013-6280 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit
Fixed in
2.1.2
What to do
Update Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit to 2.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Oct 23, 2013SQL injection vulnerability in the Landing Pages plugin 1.2.3, before 20131009, and earlier for WordPress allows remote attackers to execute arbitrary SQL commaCVE-2013-6243 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Landing Pages plugin 1.2.3, before 20131009, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the "post" parameter to index.php.
Product
Landing Pages
Fixed in
20131009
What to do
Update Landing Pages to 20131009 or newer.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Oct 9, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijackCVE-2013-0736 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) modify user privileges or (2) conduct cross-site scripting (XSS) attacks via unspecified vectors.
Product
Mingle Forum
What to do
Update Mingle Forum to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 3, 2013Cross-site scripting (XSS) vulnerability in the Comment Attachment plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2013-6010 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Comment Attachment plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Attachment field title."
Product
Comment Attachment
What to do
Update Comment Attachment to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Sep 30, 2013Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary coCVE-2013-5963 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/wpdb/.
Product
Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload
Fixed in
1.8.8.1
What to do
Update Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload to 1.8.8.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 30, 2013frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for: Unrestricted file uploadCVE-2013-5962 · WordPress plugins & themes · reported by MITREMedium 5.1
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
Product
frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for
Fixed in
3.3.4
What to do
Update frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for to 3.3.4 or newer.
Full record and what to do →NVD record archives.neohapsis.com codecanyon.net
Sep 30, 2013Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploadCVE-2013-5961 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in lazy-seo/.
Product
Lazy SEO
What to do
Update Lazy SEO to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Sep 26, 2013Cross-site scripting (XSS) vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2013-4626 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the BackWPup
Fixed in
3.0.13
What to do
Update Cross-site scripting (XSS) vulnerability in the BackWPup to 3.0.13 or newer.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Sep 23, 2013Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attackers to inject arbitrCVE-2013-5918 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO
Fixed in
1.3.8
What to do
Update Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO to 1.3.8 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Sep 23, 2013SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via theCVE-2013-5917 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the comment_post_ID parameter.
Product
NOSpam PTI
What to do
Update NOSpam PTI to the newest version.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Sep 17, 2013Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackCVE-2013-5711 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System
Fixed in
3.7
What to do
Update Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System to 3.7 or newer.
Full record and what to do →NVD record archives.neohapsis.com wordpress.org
Sep 12, 2013wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and proviCVE-2013-4340 · WordPress plugins & themes · reported by Red HatLow 3.5
wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.
Fixed in
3.6.1
What to do
Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Sep 10, 2013SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands viCVE-2013-5673 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php.
Product
IndiaNIC Testimonial
What to do
Update IndiaNIC Testimonial to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Sep 10, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authenticatCVE-2013-5672 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add a testimonial via an iNIC_testimonial_save action; (2) add a listing template via an iNIC_testimonial_save_listing_template action; (3) add a widget template via an iNIC_testimonial_save_widget action; insert cross-site scripting (XSS) sequences via the (4) project_name, (5) project_url, (6) client_name, (7) client_city, (8) client_state, (9) description, (10) tags, (11) video_url, or (12) is_featured, (13) title, (14) widget_title, (15) no_of_testimonials, (16) filter_by_country, (17) filter_by_tags, or (18) widget_template parameter to wp-admin/admin-ajax.php.
Product
IndiaNIC Testimonial
What to do
Update IndiaNIC Testimonial to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Sep 9, 2013Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WorCVE-2013-5714 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) message parameter. NOTE: some of these details are obtained from third party information.
Product
VideoWhisper Live Streaming Integration
What to do
Update VideoWhisper Live Streaming Integration to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Sep 4, 2013Cross-site request forgery (CSRF) vulnerability in the ShareThis plugin before 7.0.6 for WordPress allows remote attackers to hijack the authentication of adminCVE-2013-3479 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the ShareThis plugin before 7.0.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the ShareThis
Fixed in
7.0.6
What to do
Update Cross-site request forgery (CSRF) vulnerability in the ShareThis to 7.0.6 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-5098 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 9, 2013Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arCVE-2013-4625 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.
Product
Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator
Fixed in
0.4.5
What to do
Update Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator to 0.4.5 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-3262 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.