Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
630 results · page 12 of 13
Jul 6, 2021wpForo Forum: Did not validate the redirect_to parameter in the login form of the forumCVE-2021-24406 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands)
- Product
- wpForo Forum
- Fixed in
- 1.9.7
- What to do
- Update wpForo Forum to 1.9.7 or newer.
Jun 1, 2021WP Login Security and History: Did not have CSRF checkCVE-2021-24328 · WordPress plugins & themes · reported by WPScanMedium 6.2
The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well
- Product
- WP Login Security and History
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Login Security and History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 24, 2021Ultimate Member – User Profile, User Registration, Login & Membership: Did not properly sanitiseCVE-2021-24306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.
- Product
- Ultimate Member – User Profile, User Registration, Login & Membership
- Fixed in
- 2.1.20
- What to do
- Update Ultimate Member – User Profile, User Registration, Login & Membership to 2.1.20 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin beforeCVE-2021-24195 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Login as User or Customer (User Switching)
- Fixed in
- 1.8
- What to do
- Update Login as User or Customer (User Switching) to 1.8 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin beCVE-2021-24194 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Login Protection - Limit Failed Login Attempts
- Fixed in
- 2.9
- What to do
- Update Login Protection - Limit Failed Login Attempts to 2.9 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress pluginCVE-2021-24189 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Captchinoo, Google recaptcha for admin login page
- Fixed in
- 2.4
- What to do
- Update Captchinoo, Google recaptcha for admin login page to 2.4 or newer.
May 6, 2021The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected CCVE-2021-24214 · WordPress plugins & themes · reported by WPScanMedium 6.1
The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.
- What to do
- Update the plugin to the newest version.
Apr 22, 2021Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments: Does not sanitise the invitaion_code GET parameterCVE-2021-24239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
- Product
- Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments
- Fixed in
- 3.7.0.1
- What to do
- Update Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments to 3.7.0.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 12, 2021Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon: The WordPress login form (wp-loginCVE-2021-24228 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized.
- Product
- Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon
- Fixed in
- 1.7.2
- What to do
- Update Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon to 1.7.2 or newer.
Jan 6, 2021The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conducCVE-2012-10001 · WordPress plugins & themes · reported by MITRECritical 9.8
The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts.
- Product
- Limit Login Attempts
- Fixed in
- 1.7.1
- What to do
- Update Limit Login Attempts to 1.7.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/aCVE-2020-35934 · WordPress plugins & themes · reported by MITREMedium 4.3
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).
- Product
- Advanced Access Manager
- Fixed in
- 6.6.2
- What to do
- Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 21, 2020LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-ForCVE-2020-35590 · WordPress plugins & themes · reported by MITRECritical 9.8
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
- Product
- LimitLoginAttempts.php in the limit-login-attempts-reloaded
- Fixed in
- 2.17.4
- What to do
- Update LimitLoginAttempts.php in the limit-login-attempts-reloaded to 2.17.4 or newer.
Full record and what to do →NVD recordn4nj0.github.iowordpress.org
Dec 21, 2020The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS.CVE-2020-35589 · WordPress plugins & themes · reported by MITREMedium 5.4
The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.
- Product
- limit-login-attempts-reloaded
- Fixed in
- 2.17.4
- What to do
- Update limit-login-attempts-reloaded to 2.17.4 or newer.
Full record and what to do →NVD recordn4nj0.github.iowordpress.org
Oct 21, 2020The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.CVE-2020-27615 · WordPress plugins & themes · reported by MITRECritical 9.8
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
- Product
- Loginizer
- Fixed in
- 1.6.4
- What to do
- Update Loginizer to 1.6.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpdeeply.com
Oct 2, 2020The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token.CVE-2020-26511 · WordPress plugins & themes · reported by MITREHigh 7.5
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.
- Product
- wpo365-login
- Fixed in
- 11.7
- What to do
- Update wpo365-login to 11.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 1, 2020An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.CVE-2020-7948 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.
- Product
- An issue was discovered in the Login by Auth0
- Fixed in
- 4.0.0
- What to do
- Update An issue was discovered in the Login by Auth0 to 4.0.0 or newer.
Apr 1, 2020An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.CVE-2020-7947 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.
- Product
- An issue was discovered in the Login by Auth0
- Fixed in
- 4.0.0
- What to do
- Update An issue was discovered in the Login by Auth0 to 4.0.0 or newer.
Apr 1, 2020The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.CVE-2020-6753 · WordPress plugins & themes · reported by MITREMedium 6.1
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.
- Product
- Login by Auth0
- Fixed in
- 4.0.0
- What to do
- Update Login by Auth0 to 4.0.0 or newer.
Feb 17, 2020Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php.CVE-2020-6850 · WordPress plugins & themes · reported by MITREMedium 6.1
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.
- Product
- Utilities.php in the miniorange-saml-20-single-sign-on
- Fixed in
- 4.8.84
- What to do
- Update Utilities.php in the miniorange-saml-20-single-sign-on to 4.8.84 or newer.
Full record and what to do →NVD recordwordpress.orgzeroauth.ltd
Feb 5, 2020The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.CVE-2019-20173 · WordPress plugins & themes · reported by MITREMedium 6.1
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
- Product
- Auth0 wp-auth0 plugin 3.11.x
- Fixed in
- 3.11.3
- What to do
- Update Auth0 wp-auth0 plugin 3.11.x to 3.11.3 or newer.
Oct 22, 2019The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.CVE-2015-9498 · WordPress plugins & themes · reported by MITREHigh 8.8
The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.
- Product
- wps-hide-login
- Fixed in
- 1.1
- What to do
- Update wps-hide-login to 1.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 11, 2019The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, uCVE-2015-9492 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers SmartIT Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers SmartIT Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, CVE-2015-9491 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Blessing Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Blessing Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_passCVE-2015-9490 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers GamesTheme Premium
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers GamesTheme Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, uCVE-2015-9489 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Goodnex Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Goodnex Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, CVE-2015-9487 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Almera Responsive Portfolio
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Almera Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, usCVE-2015-9486 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Axioma Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Axioma Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_paCVE-2015-9481 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Diplomat | Political
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Diplomat | Political to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 16, 2019The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.CVE-2016-10971 · WordPress plugins & themes · reported by MITRECritical 9.8
The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
- Product
- MemberSonic Lite
- Fixed in
- 1.302
- What to do
- Update MemberSonic Lite to 1.302 or newer.
Full record and what to do →NVD recordpritect.netpritect.net
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-15872 · WordPress plugins & themes · reported by MITRECritical 9.8
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
- Product
- LoginPress
- Fixed in
- 1.1.4
- What to do
- Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD recordwordpress.orgwebarxsecurity.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.CVE-2019-15871 · WordPress plugins & themes · reported by MITREMedium 4.3
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
- Product
- LoginPress
- Fixed in
- 1.1.4
- What to do
- Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD recordwordpress.orgwebarxsecurity.com
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.CVE-2019-15826 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.CVE-2019-15825 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.CVE-2019-15824 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.CVE-2019-15823 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.CVE-2019-15820 · WordPress plugins & themes · reported by MITREMedium 6.1
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
- Product
- login-or-logout-menu-item
- Fixed in
- 1.2.0
- What to do
- Update login-or-logout-menu-item to 1.2.0 or newer.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Aug 22, 2019The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.CVE-2016-10928 · WordPress plugins & themes · reported by MITREHigh 7.5
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
- Product
- onelogin-saml-sso
- Fixed in
- 2.2.0
- What to do
- Update onelogin-saml-sso to 2.2.0 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Aug 22, 2019The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.CVE-2016-10925 · WordPress plugins & themes · reported by MITREMedium 6.1
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
- Product
- peters-login-redirect
- Fixed in
- 2.9.1
- What to do
- Update peters-login-redirect to 2.9.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18573 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
- Product
- simple-login-log
- Fixed in
- 1.1.2
- What to do
- Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The clean-login plugin before 1.5.1 for WordPress has reflected XSS.CVE-2015-9336 · WordPress plugins & themes · reported by MITREMedium 6.1
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
- Product
- clean-login
- Fixed in
- 1.5.1
- What to do
- Update clean-login to 1.5.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 16, 2019The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.CVE-2019-15115 · WordPress plugins & themes · reported by MITREHigh 8.8
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
- Product
- peters-login-redirect
- Fixed in
- 2.9.2
- What to do
- Update peters-login-redirect to 2.9.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 16, 2019The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.CVE-2015-9322 · WordPress plugins & themes · reported by MITREHigh 8.8
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
- Product
- erident-custom-login-and-dashboard
- Fixed in
- 3.5
- What to do
- Update erident-custom-login-and-dashboard to 3.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18514 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
- Product
- simple-login-log
- Fixed in
- 1.1.2
- What to do
- Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.CVE-2017-18501 · WordPress plugins & themes · reported by MITREMedium 6.1
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
- Product
- social-login-bws
- Fixed in
- 0.2
- What to do
- Update social-login-bws to 0.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.CVE-2016-10872 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
- Product
- ultimate-member
- Fixed in
- 1.3.40
- What to do
- Update ultimate-member to 1.3.40 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jun 24, 2019In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XCVE-2019-12346 · WordPress plugins & themes · reported by MITREMedium 6.1
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.
- Product
- In the miniOrange SAML SP Single Sign On
- Fixed in
- 4.8.73
- What to do
- Update In the miniOrange SAML SP Single Sign On to 4.8.73 or newer.
Full record and what to do →NVD recordwpvulndb.comzeroauth.ltd
Oct 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0CVE-2018-17866 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field.
- Fixed in
- 2.0.28
- What to do
- Update the plugin to 2.0.28 or newer.
Full record and what to do →NVD recordserhack.mewordpress.org
Aug 26, 2018An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress.CVE-2018-15876 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished by automation.
- Product
- ajax-bootmodal-login
- What to do
- Update ajax-bootmodal-login to the newest version.
May 22, 2018init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled.CVE-2018-11366 · WordPress plugins & themes · reported by MITREMedium 6.1
init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled. This is fixed in 1.4.0.
- Product
- init.php in the Loginizer plugin 1.3.8
- Affected
- up to 1.3.9
- Fixed in
- 1.4.0
- What to do
- Update init.php in the Loginizer plugin 1.3.8 to 1.4.0 or newer.
Full record and what to do →NVD recordblog.dewhurstsecurity.complugins.trac.wordpress.org
Apr 16, 2018Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.CVE-2018-10100 · WordPress plugins & themes · reported by MITREMedium 6.1
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecuritytracker.comcodex.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.