Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

574 results · page 12 of 12

Sep 23, 2017Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.CVE-2017-14720 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Aug 1, 2017The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More TCVE-2017-12131 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.
Affected
3.0.4 to 3.0.4
What to do
Affects 3.0.4 to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Nov 9, 2015the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5734 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.
Product
the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Dec 2, 2014SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands CVE-2014-9173 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter.
Product
SQL injection vulnerability in view.php in the Google Doc Embedder
Fixed in
2.5.15
What to do
Update SQL injection vulnerability in view.php in the Google Doc Embedder to 2.5.15 or newer.
Full record and what to do →NVD record osvdb.org security.szurek.pl
Nov 26, 2014Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remCVE-2014-9094 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record seclists.org websecurity.com.ua
Nov 4, 2014SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the caliCVE-2014-8586 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter.
Product
CP Multi View Event Calendar
What to do
Update CP Multi View Event Calendar to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Oct 21, 2014Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackersCVE-2014-4577 · WordPress plugins & themes · reported by MITREMedium 5
Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.
Product
WP AmASIN - The Amazon Affiliate Shop
Affected
up to 0.9.6
What to do
Affects up to 0.9.6. Update WP AmASIN - The Amazon Affiliate Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com plugins.svn.wordpress.org
Aug 12, 2014SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter iCVE-2014-5201 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a go_view_object action to wp-admin/admin-ajax.php.
Product
Gallery Objects
Affected
0.4 to 0.4
What to do
Affects 0.4 to 0.4. Update Gallery Objects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com homelab.it
Jul 2, 2014Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbiCVE-2014-4594 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Product
Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview
Fixed in
1.2
What to do
Update Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview to 1.2 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org
Jul 2, 2014Cross-site scripting (XSS) vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earlier for WordPress alCVE-2014-4541 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
Product
OMFG Mobile Pro
Affected
up to 1.1.26
What to do
Affects up to 1.1.26. Update OMFG Mobile Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arCVE-2014-4529 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.
Product
Flash Photo Gallery
Affected
up to 0.7
What to do
Affects up to 0.7. Update Flash Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inCVE-2014-4516 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the param parameter.
Product
BIC Media Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update BIC Media Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Apr 10, 2014Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijackCVE-2013-3252 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews
Fixed in
1.63
What to do
Update Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews to 1.63 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 7, 2014Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows CVE-2012-1834 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php.
Product
Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View
Fixed in
0.8.9
What to do
Update Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View to 0.8.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Apr 4, 2014Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary weCVE-2013-2287 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) notify or (2) blog parameter.
Product
Uploader
What to do
Update Uploader to the newest version.
Full record and what to do →NVD record osvdb.org dognaedis.com
Jan 20, 2014wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated userCVE-2012-6635 · WordPress plugins & themes · reported by MITREMedium 4
wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft.
Fixed in
3.3.3
What to do
Update the plugin to 3.3.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 8, 2014Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers tCVE-2013-7279 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter.
Product
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video
Fixed in
0.983
What to do
Update Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video to 0.983 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jul 16, 2013Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to injCVE-2013-4117 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
Product
Category Grid View Gallery
What to do
Update Category Grid View Gallery to the newest version.
Full record and what to do →NVD record exploit.iedb.ir openwall.com
Mar 22, 2013Cross-site scripting (XSS) vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2013-2501 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ProfileId field.
Product
Cross-site scripting (XSS) vulnerability in the Terillion Reviews
Fixed in
1.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Terillion Reviews to 1.2 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Jun 19, 2012Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-3588 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.
Product
Plugin Newsletter
What to do
Update Plugin Newsletter to the newest version.
Full record and what to do →NVD record secunia.com exploit-db.com
Nov 29, 2011Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrCVE-2011-4568 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.
Product
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer
Fixed in
1.2.12
What to do
Update Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer to 1.2.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Nov 28, 2011Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WCVE-2011-4562 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.
Product
Redirection
What to do
Update Redirection to the newest version.
Full record and what to do →NVD record dotxed.net osvdb.org
Jun 19, 2009SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands CVE-2009-2122 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Paolo Palmonari Photoracer
What to do
Update Paolo Palmonari Photoracer to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Feb 11, 2008shiftthis-preview.php in the ShiftThis Newsletter: SQL injectionCVE-2008-0683 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.
Product
shiftthis-preview.php in the ShiftThis Newsletter
What to do
Update shiftthis-preview.php in the ShiftThis Newsletter to the newest version.
Full record and what to do →NVD record securityfocus.com exploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.