Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

572 results · page 12 of 12

Oct 1, 2018XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.CVE-2015-9270 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
Product
XSS exists in the the-holiday-calendar
Fixed in
1.11.3
What to do
Update XSS exists in the the-holiday-calendar to 1.11.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Jun 13, 2018An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress.CVE-2018-10363 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.
Product
WpDevArt "Booking calendar, Appointment Booking System
Affected
2.2.2 to 2.2.2
What to do
Affects 2.2.2 to 2.2.2. Update WpDevArt "Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com gist.github.com
Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5673 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.
Product
booking-calendar
Affected
2.1.7 to 2.1.7
What to do
Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5672 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.
Product
booking-calendar
Affected
2.1.7 to 2.1.7
What to do
Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5671 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.
Product
booking-calendar
Affected
2.1.7 to 2.1.7
What to do
Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5670 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.
Product
booking-calendar
Affected
2.1.7 to 2.1.7
What to do
Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.CVE-2018-5315 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jul 7, 2017Event Calendar WD prior to version 1.0.94: Cross-site scriptingCVE-2017-2224 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Event Calendar WD prior to version 1.0.94
Affected
up to 1.0.93
What to do
Affects up to 1.0.93. Update Event Calendar WD prior to version 1.0.94 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com jvn.jp
Jun 5, 2017Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via theCVE-2017-9420 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.
Product
Cross site scripting (XSS) vulnerability in the Spiffy Calendar
Fixed in
3.3.0
What to do
Update Cross site scripting (XSS) vulnerability in the Spiffy Calendar to 3.3.0 or newer.
Full record and what to do →NVD record spiffycalendar.sunnythemes.com securityfocus.com
Apr 12, 2017SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendarCVE-2017-7719 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.
Product
SQL injection in the Spider Event Calendar (aka spider-event-calendar)
Fixed in
1.5.52
What to do
Update SQL injection in the Spider Event Calendar (aka spider-event-calendar) to 1.5.52 or newer.
Full record and what to do →NVD record lists.openwall.net securityfocus.com
Sep 29, 2015Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.CVE-2015-7320 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Fixed in
1.1.8
What to do
Update the plugin to 1.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 29, 2015SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows rCVE-2015-7319 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
Product
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar
Fixed in
1.1.8
What to do
Update SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar to 1.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 17, 2015Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to executCVE-2015-7235 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
Product
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar
Fixed in
1.1.7
What to do
Update Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar to 1.1.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 3, 2015Spider Event Calendar 1.4.9 for: SQL injectionCVE-2015-2196 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.
Product
Spider Event Calendar 1.4.9 for
Affected
1.4.9 to 1.4.9
What to do
Affects 1.4.9 to 1.4.9. Update Spider Event Calendar 1.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Nov 4, 2014SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the caliCVE-2014-8586 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter.
Product
CP Multi View Event Calendar
What to do
Update CP Multi View Event Calendar to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script CVE-2014-7138 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the Google Calendar Events
Fixed in
2.0.4
What to do
Update Cross-site scripting (XSS) vulnerability in the Google Calendar Events to 2.0.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbCVE-2014-4571 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fs or (2) w parameter.
Product
VN-Calendar
Affected
up to 1.0
What to do
Affects up to 1.0. Update VN-Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com securityfocus.com
May 27, 2014Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users CVE-2013-2698 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Calendar
Fixed in
1.3.3
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Calendar to 1.3.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 22, 2014SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated userCVE-2014-3210 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the booking_form_id parameter to wp-admin/admin-ajax.php.
Product
SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar)
Fixed in
1.3
What to do
Update SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) to 1.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Jan 31, 2013Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2012-6527 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Product
Cross-site scripting (XSS) vulnerability in the My Calendar
Fixed in
1.10.2
What to do
Update Cross-site scripting (XSS) vulnerability in the My Calendar to 1.10.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Oct 1, 2012Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via thCVE-2012-4242 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page.
Product
MF Gig Calendar
What to do
Update MF Gig Calendar to the newest version.
Full record and what to do →NVD record reactionpenetrationtesting.co.uk securityfocus.com
Aug 14, 2012Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitraryCVE-2012-1835 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.