Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

550new WordPress flaws this week

392,577entries in the database

5,703 results · page 114 of 115

Aug 9, 2013Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows remote attackers to hijCVE-2013-3253 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change unspecified settings.
Product
Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter
Fixed in
2.7.7
What to do
Update Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter to 2.7.7 or newer.
Full record and what to do →NVD record forum.xhanch.com plugins.trac.wordpress.org
Aug 8, 2013Cross-site request forgery (CSRF) vulnerability in the Shareaholic SexyBookmarks plugin 6.1.4.0 for WordPress allows remote attackers to hijack the authenticatiCVE-2013-3256 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Shareaholic SexyBookmarks plugin 6.1.4.0 for WordPress allows remote attackers to hijack the authentication of users for requests that "manipulate plugin settings."
Product
Shareaholic SexyBookmarks
What to do
Update Shareaholic SexyBookmarks to the newest version.
Full record and what to do →NVD record secunia.com wordpress.org
Jul 29, 2013Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" componenCVE-2013-4944 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" component is enabled, allows remote attackers to inject arbitrary web script or HTML via the friendship_request_message parameter to wp-admin/admin-ajax.php. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request
Fixed in
1.0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request to 1.0.2 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Jul 16, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the Sharebar plugin 1.2.5 for WordPress allow remote attackers to hijack the authentication of admCVE-2013-3491 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Sharebar plugin 1.2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) modify buttons, or (3) insert cross-site scripting (XSS) sequences.
Product
Sharebar
What to do
Update Sharebar to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Jul 12, 2013Cross-site request forgery (CSRF) vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote attackers to hijack the authentication of aCVE-2013-2704 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences.
Product
Dropdown Menu Widget
What to do
Update Dropdown Menu Widget to the newest version.
Full record and what to do →NVD record secunia.com wordpress.org
Jul 8, 2013WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, CVE-2013-2203 · WordPress plugins & themes · reported by Red HatMedium 4.3
WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record codex.wordpress.org wordpress.org
Jul 8, 2013The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side RequeCVE-2013-2199 · WordPress plugins & themes · reported by Red HatMedium 4.3
The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record codex.wordpress.org wordpress.org
Jul 8, 2013The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a cCVE-2013-0235 · WordPress plugins & themes · reported by Red HatMedium 6.4
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
Fixed in
3.5.1
What to do
Update the plugin to 3.5.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jun 21, 2013Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authenticatioCVE-2013-3250 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode
Fixed in
1.8.8
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode to 1.8.8 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 10, 2013Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of aCVE-2013-2707 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the Login With Ajax
Fixed in
3.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Login With Ajax to 3.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 5, 2013Cross-site request forgery (CSRF) vulnerability in the Facebook Members plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication oCVE-2013-2703 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Facebook Members plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the Facebook Members
Fixed in
5.0.5
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Facebook Members to 5.0.5 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 5, 2013Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite plugin before 6.10 for WordPress allows remote attackers to hijack the authentication oCVE-2013-2702 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite plugin before 6.10 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite
Fixed in
6.10
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite to 6.10 or newer.
Full record and what to do →NVD record secunia.com secunia.com
Apr 26, 2013Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication CVE-2013-2709 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins
Fixed in
1.3
What to do
Update Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins to 1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 25, 2013Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authenticatiCVE-2013-2696 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster
Fixed in
8.2.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster to 8.2.4 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 19, 2013Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication CVE-2013-2697 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager
Fixed in
1.61
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager to 1.61 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 2, 2013importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows reCVE-2013-2741 · WordPress plugins & themes · reported by MITREHigh 7.5
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Jan 2, 2013wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals thCVE-2013-0721 · WordPress plugins & themes · reported by MITREMedium 5
wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
Product
WP PHP widget
What to do
Update WP PHP widget to the newest version.
Full record and what to do →NVD record osvdb.org osvdb.org
Dec 20, 2012The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct reqCVE-2012-5469 · WordPress plugins & themes · reported by MITREHigh 7.5
The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod.
Product
Portable phpMyAdmin
Fixed in
1.3.1
What to do
Update Portable phpMyAdmin to 1.3.1 or newer.
Full record and what to do →NVD record archives.neohapsis.com wordpress.org
Dec 19, 2012Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitraCVE-2012-5178 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that complete a purchase.
Product
Cross-site request forgery (CSRF) vulnerability in the Welcart
Fixed in
1.2.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Welcart to 1.2.2 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Dec 11, 2012simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that laCVE-2012-6313 · WordPress plugins & themes · reported by MITREMedium 5
simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that lacks a timezone, leading to disclosure of the installation path in a stack trace.
Product
simple-gmail-login.php in the Simple Gmail Login
Fixed in
1.1.4
What to do
Update simple-gmail-login.php in the Simple Gmail Login to 1.1.4 or newer.
Full record and what to do →NVD record archives.neohapsis.com wordpress.org
Oct 25, 2012Cross-site request forgery (CSRF) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to hijack the autheCVE-2011-5226 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to hijack the authentication of an administrator for requests that trigger snapshots.
Product
Sentinel
What to do
Update Sentinel to the newest version.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Oct 24, 2012Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack tCVE-2012-5387 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, as demonstrated by a developer name containing XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS
Fixed in
1.5.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS to 1.5.1 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Sep 28, 2012wp-admin/index.php in WordPress 3.4.2: Cross-site request forgery (CSRF)CVE-2012-4448 · WordPress plugins & themes · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action.
Product
wp-admin/index.php in WordPress 3.4.2
What to do
Update wp-admin/index.php in WordPress 3.4.2 to the newest version.
Full record and what to do →NVD record openwall.com packetstormsecurity.org
Jul 22, 2012the customizer in WordPress before 3.4.1: Cross-site request forgery (CSRF)CVE-2012-3384 · WordPress plugins & themes · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
the customizer in WordPress before 3.4.1
Fixed in
3.4.1
What to do
Update the customizer in WordPress before 3.4.1 to 3.4.1 or newer.
Full record and what to do →NVD record codex.wordpress.org openwall.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameteCVE-2011-4898 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Sep 23, 2011WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in anCVE-2011-3818 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record code.google.com code.google.com
Mar 28, 2011Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress aCVE-2011-0760 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the (1) wp_relatedposts_title, (2) wp_relatedposts_num, or (3) wp_relatedposts_type parameter.
Product
WP Related Posts
What to do
Update WP Related Posts to the newest version.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Mar 22, 2011Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remoCVE-2011-0759 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting (XSS) sequences via the (1) recaptcha_opt_pubkey, (2) recaptcha_opt_privkey, (3) re_tabindex, (4) error_blank, (5) error_incorrect, (6) mailhide_pub, (7) mailhide_priv, (8) mh_replace_link, or (9) mh_replace_title parameter.
Product
Recaptcha (aka WP-reCAPTCHA)
What to do
Update Recaptcha (aka WP-reCAPTCHA) to the newest version.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Dec 6, 2010The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php andCVE-2010-4403 · WordPress plugins & themes · reported by MITREMedium 5
The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message.
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org websecurity.com.ua
Feb 23, 2010WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.CVE-2010-0682 · WordPress plugins & themes · reported by MITREMedium 4
WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.
Fixed in
2.9.2
What to do
Update the plugin to 2.9.2 or newer.
Full record and what to do →NVD record hakre.wordpress.com lists.fedoraproject.org
Dec 2, 2009WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.CVE-2009-4170 · WordPress plugins & themes · reported by MITREMedium 5
WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record websecurity.com.ua securityfocus.com
Aug 18, 2009Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct requeCVE-2009-2854 · WordPress plugins & themes · reported by MITREMedium 6.4
Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/.
Fixed in
2.8.3
What to do
Update the plugin to 2.8.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Aug 18, 2009Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advancCVE-2009-2853 · WordPress plugins & themes · reported by MITREHigh 10
Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.
Fixed in
2.8.3
What to do
Update the plugin to 2.8.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Jul 10, 2009WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the instalCVE-2009-2432 · WordPress plugins & themes · reported by MITREMedium 5
WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.
Fixed in
2.8.1
What to do
Update the plugin to 2.8.1 or newer.
Full record and what to do →NVD record corelabs.coresecurity.com securitytracker.com
Jul 10, 2009The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user accountCVE-2009-2336 · WordPress plugins & themes · reported by MITREMedium 5
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Fixed in
2.8.1
What to do
Update the plugin to 2.8.1 or newer.
Full record and what to do →NVD record corelabs.coresecurity.com securitytracker.com
Jul 10, 2009wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which alloCVE-2009-2334 · WordPress plugins & themes · reported by MITREMedium 4.9
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
Fixed in
2.8.1
What to do
Update the plugin to 2.8.1 or newer.
Full record and what to do →NVD record corelabs.coresecurity.com securitytracker.com
Dec 19, 2008wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remoteCVE-2008-5695 · WordPress plugins & themes · reported by MITREHigh 8.5
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.
Affected
up to 2.3.2
Fixed in
1.3.2
What to do
Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD record mu.wordpress.org secunia.com
Nov 17, 2008WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persiCVE-2008-5113 · WordPress plugins & themes · reported by MITREMedium 4
WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access). NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record bugs.debian.org openwall.com
Oct 24, 2008Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackeCVE-2008-4734 · WordPress plugins & themes · reported by MITREHigh 7.5
Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to perform unauthorized actions as administrators via a request that sets the wpcr_hidden_form_input parameter.
Product
Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix
Fixed in
1.4.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix to 1.4.4 or newer.
Full record and what to do →NVD record chxsecurity.org secunia.com
Jan 31, 2008deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for: Cross-site request forgery (CSRF)CVE-2008-0508 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the oldstructure (aka dean_pm_config[oldstructure]) configuration setting as administrators via the old_struct parameter in a deans_permalinks_migration.php action to wp-admin/options-general.php, as demonstrated by placing an XSS sequence in this setting.
Product
deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for
What to do
Update deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for to the newest version.
Full record and what to do →NVD record g30rg3x.com g30rg3x.com
Jan 9, 2008Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WoCVE-2008-0205 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.
Affected
up to 2.1
What to do
Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Jan 9, 2008Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WorCVE-2008-0198 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Oct 5, 2007the FeedBurner FeedSmith 2.2 plugin for: Cross-site request forgery (CSRF)CVE-2007-5229 · WordPress plugins & themes · reported by MITREMedium 6.4
Cross-site request forgery (CSRF) vulnerability in the FeedBurner FeedSmith 2.2 plugin for WordPress allows remote attackers to change settings and hijack blog feeds via a request to wp-admin/options-general.php that submits parameter values to FeedBurner_FeedSmith_Plugin.php, as demonstrated by the (1) feedburner_url and (2) feedburner_comments_url parameters.
Product
the FeedBurner FeedSmith 2.2 plugin for
What to do
Update the FeedBurner FeedSmith 2.2 plugin for to the newest version.
Full record and what to do →NVD record blogs.feedburner.com blogsecurity.net
May 22, 2007adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for: Cross-site request forgery (CSRF)CVE-2007-2828 · WordPress plugins & themes · reported by MITREMedium 6
Cross-site request forgery (CSRF) vulnerability in adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for WordPress allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors.
Product
adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for
What to do
Update adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for to the newest version.
Full record and what to do →NVD record michaeldaw.org osvdb.org
Mar 10, 2007WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error messCVE-2007-1409 · WordPress plugins & themes · reported by MITREMedium 5
WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com gentoo.org
Mar 3, 2007the AdminPanel in WordPress 2.1.1 and earlier: Cross-site request forgery (CSRF)CVE-2007-1244 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.
Product
the AdminPanel in WordPress 2.1.1 and earlier
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update the AdminPanel in WordPress 2.1.1 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Sep 13, 2006WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (3) archive.php, (4CVE-2006-4743 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (3) archive.php, (4) archives.php, (5) attachment.php, (6) blogger.php, (7) comments.php, (8) comments-popup.php, (9) dotclear.php, (10) footer.php, (11) functions.php, (12) header.php, (13) hello.php, (14) wp-content/themes/default/index.php, (15) links.php, (16) livejournal.php, (17) mt.php, (18) page.php, (19) rss.php, (20) searchform.php, (21) search.php, (22) sidebar.php, (23) single.php, (24) textpattern.php, (25) upgrade-functions.php, (26) upgrade-schema.php, or (27) wp-db-backup.php, which reveal the path in various error messages. NOTE: another researcher has disputed the details of this report, stating that version 2.0.5 does not exist. NOTE: the admin-footer.php, admin-functions.php, default-filters.php, edit-form-advanced.php, edit-link-form.php, edit-page-form.php, kses.php, locale.php, rss-functions.php, template-loader.php, and wp-db.php vectors are already covered by CVE-2006-0986. The edit-form-comment.php, vars.php, and wp-settings.php vectors are already covered by CVE-2005-4463. The menu-header.php vector is already cover
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jul 6, 2006WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-contentCVE-2006-3390 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com secunia.com
Mar 3, 2006WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) template-loader.php, (3CVE-2006-0986 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) template-loader.php, (3) rss-functions.php, (4) locale.php, (5) wp-db.php, and (6) kses.php in the wp-includes/ directory; and (7) edit-form-advanced.php, (8) admin-functions.php, (9) edit-link-form.php, (10) edit-page-form.php, (11) admin-footer.php, and (12) menu.php in the wp-admin directory; and possibly (13) list directory contents of the wp-includes directory. NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors are already covered by CVE-2005-4463. The menu-header.php vector is already covered by CVE-2005-2110. Other vectors might be covered by CVE-2005-1688. NOTE: if the typical installation of WordPress does not list any site-specific files to wp-includes, then vector [13] is not an exposure.
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record neosecurityteam.net secunia.com
Dec 21, 2005WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-content/plugins/hello.phCVE-2005-4463 · WordPress plugins & themes · reported by MITREMedium 5
WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-content/plugins/hello.php, (3) wp-admin/upgrade-functions.php, (4) wp-admin/edit-form.php, (5) wp-settings.php, and (6) wp-admin/edit-form-comment.php, which leaks the path in an error message related to undefined functions or failed includes. NOTE: the wp-admin/menu-header.php vector is already covered by CVE-2005-2110. NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors were also reported to affect WordPress 2.0.1.
Fixed in
1.5.2
What to do
Update the plugin to 1.5.2 or newer.
Full record and what to do →NVD record neosecurityteam.net echo.or.id

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.