Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

485new WordPress flaws this week

392,772entries in the database

6,587 results · page 128 of 132

Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2014-4519 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the 'page' parameter.
Product
Conversador
Affected
up to 2.61
What to do
Affects up to 2.61. Update Conversador to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web scriptCVE-2014-4523 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Product
Easy Career Openings
Affected
up to 0.4
What to do
Affects up to 0.4. Update Easy Career Openings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 25, 2019In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered.CVE-2019-19983 · WordPress plugins & themes · reported by MITREMedium 4.3
In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.
Fixed in
2.7.7
What to do
Update the plugin to 2.7.7 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Oct 22, 2019The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.CVE-2015-9501 · WordPress plugins & themes · reported by MITREMedium 6.1
The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.
Product
Artificial Intelligence
Fixed in
1.2.4
What to do
Update Artificial Intelligence to 1.2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Oct 22, 2019The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.CVE-2015-9494 · WordPress plugins & themes · reported by MITREMedium 6.1
The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.
Product
indieweb-post-kinds
Fixed in
1.3.1.1
What to do
Update indieweb-post-kinds to 1.3.1.1 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Oct 6, 2019The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI.CVE-2019-17214 · WordPress plugins & themes · reported by MITREHigh 7.5
The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI.
Affected
1.3.0 to 1.3.0
What to do
Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 6, 2019The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.CVE-2019-17213 · WordPress plugins & themes · reported by MITREMedium 6.1
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
Affected
1.3.0 to 1.3.0
What to do
Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com acunetix.com
Sep 20, 2019The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.CVE-2015-9401 · WordPress plugins & themes · reported by MITREMedium 4.8
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
Product
websimon-tables
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update websimon-tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 8, 2019SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameCVE-2019-16119 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.
Product
SQL injection in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update SQL injection in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.CVE-2019-16118 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.CVE-2019-16117 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Aug 30, 2019The webp-express plugin before 0.14.8 for WordPress has stored XSS.CVE-2019-15837 · WordPress plugins & themes · reported by MITREMedium 5.4
The webp-express plugin before 0.14.8 for WordPress has stored XSS.
Product
webp-express
Fixed in
0.14.8
What to do
Update webp-express to 0.14.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.CVE-2019-15834 · WordPress plugins & themes · reported by MITREHigh 8.8
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
Product
webp-converter-for-media
Fixed in
1.0.3
What to do
Update webp-converter-for-media to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.CVE-2019-15827 · WordPress plugins & themes · reported by MITREMedium 5.4
The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.
Product
onesignal-free-web-push-notifications
Fixed in
1.17.8
What to do
Update onesignal-free-web-push-notifications to 1.17.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such CVE-2019-14979 · WordPress plugins & themes · reported by MITREMedium 5.3
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
Product
WooCommerce PayPal Checkout Payment Gateway
Affected
1.6.17 to 1.6.17
What to do
Affects 1.6.17 to 1.6.17. Update WooCommerce PayPal Checkout Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gkaim.com wordpress.org
Aug 29, 2019The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.CVE-2019-15781 · WordPress plugins & themes · reported by MITREHigh 8.8
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
Product
facebook-by-weblizar
Fixed in
2.8.5
What to do
Update facebook-by-weblizar to 2.8.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 23, 2019The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name,CVE-2019-15092 · WordPress plugins & themes · reported by MITREHigh 7.3
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
Aug 22, 2019The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.CVE-2019-15330 · WordPress plugins & themes · reported by MITREHigh 7.5
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.
Product
webp-express
Fixed in
0.14.11
What to do
Update webp-express to 0.14.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.CVE-2017-18540 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.7
What to do
Update weblibrarian to 3.4.8.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.CVE-2017-18539 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.6
What to do
Update weblibrarian to 3.4.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.CVE-2017-18538 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.5
What to do
Update weblibrarian to 3.4.8.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=CVE-2019-14798 · WordPress plugins & themes · reported by MITREMedium 4.9
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
Product
10Web Photo Gallery
Fixed in
1.5.25
What to do
Update 10Web Photo Gallery to 1.5.25 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.CVE-2019-14797 · WordPress plugins & themes · reported by MITREMedium 5.4
The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
Product
10Web Photo Gallery
Fixed in
1.5.23
What to do
Update 10Web Photo Gallery to 1.5.23 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 30, 2019A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress.CVE-2019-14313 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.
Product
A SQL injection vulnerability exists in the 10Web Photo Gallery
Fixed in
1.5.31
What to do
Update A SQL injection vulnerability exists in the 10Web Photo Gallery to 1.5.31 or newer.
Full record and what to do →NVD record fortiguard.com plugins.trac.wordpress.org
Jul 23, 2019WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS).CVE-2019-1010124 · WordPress plugins & themes · reported by josh@bress.netMedium 5.4
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.
Affected
up to 2.2.18
What to do
Affects up to 2.2.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Jul 15, 2019Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection.CVE-2019-1010034 · WordPress plugins & themes · reported by josh@bress.netMedium 6.5
Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection. This function call can be triggered by any user logged-in with at least Volunteer role or manage_circulation capabilities. PoC : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=DESC.
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpvulndb.com
May 13, 2019Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web scripCVE-2019-7411 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL).
Product
MyThemeShop Launcher
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update MyThemeShop Launcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record metamorfosec.com wpvulndb.com
Apr 29, 2019The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion CVE-2019-11591 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form
Fixed in
1.13.5
What to do
Update WebDorado Contact Form to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 29, 2019The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via diCVE-2019-11590 · WordPress plugins & themes · reported by MITREHigh 8.8
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
10Web Form Maker
Fixed in
1.13.5
What to do
Update 10Web Form Maker to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 26, 2019The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inCVE-2019-11557 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form Builder
Fixed in
1.0.69
What to do
Update WebDorado Contact Form Builder to 1.0.69 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 23, 2019The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GETCVE-2019-10864 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
Product
WP Statistics
Affected
up to 12.6.2
What to do
Affects up to 12.6.2. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com medium.com
Mar 21, 2019cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such aCVE-2019-7441 · WordPress plugins & themes · reported by MITREMedium 6.5
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
Product
WooCommerce PayPal Checkout Payment Gateway
Affected
1.6.8 to 1.6.8
What to do
Affects 1.6.8 to 1.6.8. Update WooCommerce PayPal Checkout Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com gkaim.com
Jan 26, 2019Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers CVE-2019-6703 · WordPress plugins & themes · reported by MITRECritical 9.8
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Product
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen.CVE-2018-20151 · WordPress plugins & themes · reported by MITREHigh 7.5
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Aug 28, 2018Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2014-4932 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
Product
Cross-site scripting (XSS) vulnerability in the Wordfence Security
Fixed in
5.1.5
What to do
Update Cross-site scripting (XSS) vulnerability in the Wordfence Security to 5.1.5 or newer.
Full record and what to do →NVD record techdefencelabs.com wordfence.com
Apr 27, 2018The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.CVE-2018-10504 · WordPress plugins & themes · reported by MITREHigh 7.8
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
Product
WebDorado "Form Maker by WD
Fixed in
1.12.24
What to do
Update WebDorado "Form Maker by WD to 1.12.24 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Apr 25, 2018A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress thCVE-2018-10310 · WordPress plugins & themes · reported by MITREMedium 5.4
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context of a victim's browser.
Fixed in
2.3.10
What to do
Update the plugin to 2.3.10 or newer.
Full record and what to do →NVD record packetstormsecurity.com gist.github.com
Apr 23, 2018the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for: Cross-site scripting (XSS)CVE-2018-10301 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post.
Product
the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for
Fixed in
1.3.1
What to do
Update the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for to 1.3.1 or newer.
Full record and what to do →NVD record medium.com wpvulndb.com
Apr 23, 2018Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2018-10300 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio.
Product
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD
Fixed in
1.3.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD to 1.3.1 or newer.
Full record and what to do →NVD record medium.com wpvulndb.com
Apr 20, 2018Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web sCVE-2018-7747 · WordPress plugins & themes · reported by MITREMedium 4.8
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email transaction log, or (3) an imported form.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms
Fixed in
1.6.0-rc.1
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms to 1.6.0-rc.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com calderaforms.com
Feb 8, 2018Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2015-2329 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.3.6
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.3.6 or newer.
Full record and what to do →NVD record fortiguard.com raw.githubusercontent.com
Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6469 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_tags parameter to wp-admin/options-general.php.
Product
flickrRSS
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6468 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_id parameter to wp-admin/options-general.php.
Product
flickrRSS
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6466 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_set parameter to wp-admin/options-general.php.
Product
flickrRSS
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5656 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5655 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5654 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREE_Access_Token parameter.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5653 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizar_pffree_settings_save_get-users parameter.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Dec 19, 2017Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary webCVE-2017-17753 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cie_type, (2) cie_import, (3) cie_update, or (4) cie_ignore parameter to includes/admin/views/esb-cie-import-export-page.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export
Affected
up to 1.1
What to do
Affects up to 1.1. Update Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
Dec 19, 2017A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2017-17744 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter to view/advancedsettings.php.
Product
A cross-site scripting (XSS) vulnerability in the custom-map
Affected
up to 1.1
What to do
Affects up to 1.1. Update A cross-site scripting (XSS) vulnerability in the custom-map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.