Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
610 results · page 13 of 13
Jan 12, 2018The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5374 · WordPress plugins & themes · reported by MITREHigh 8.8
The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
- Product
- Dbox 3D Slider Lite
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Dbox 3D Slider Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddefensecode.comdefensecode.com
Jan 12, 2018The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).CVE-2018-5373 · WordPress plugins & themes · reported by MITREHigh 8.8
The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).
- Product
- Smooth Slider
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Smooth Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddefensecode.comdefensecode.com
Jan 12, 2018The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5372 · WordPress plugins & themes · reported by MITREHigh 8.8
The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
- Product
- Testimonial Slider
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddefensecode.comdefensecode.com
Jun 30, 2015Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script CVE-2015-5151 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.
- Product
- Slider Revolution (revslider)
- Affected
- 4.2.2 to 4.2.2
- What to do
- Affects 4.2.2 to 4.2.2. Update Slider Revolution (revslider) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jun 30, 2015The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restricCVE-2014-9735 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
- Product
- ThemePunch Slider Revolution (revslider)
- Affected
- up to 1.7.1
- Fixed in
- 3.0.96
- What to do
- Update ThemePunch Slider Revolution (revslider) to 3.0.96 or newer.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Jun 30, 2015Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2014-9734 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.
- Product
- Directory traversal vulnerability in the Slider Revolution (revslider)
- Fixed in
- 4.2
- What to do
- Update Directory traversal vulnerability in the Slider Revolution (revslider) to 4.2 or newer.
Full record and what to do →NVD recordmarketblog.envato.commarketblog.envato.com
Feb 16, 2015Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2015-1436 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the (1) easingslider_manage_customizations or (2) easingslider_edit_sliders page to wp-admin/admin.php.
- Product
- Cross-site scripting (XSS) vulnerability in the Easing Slider
- Fixed in
- 2.2.0.7
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Easing Slider to 2.2.0.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Dec 31, 2014SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider plugin before 7.4.2 for WordPress allows remote attackers to execute arbitrary SQL CVE-2011-5286 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider plugin before 7.4.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the rA array parameter.
- Product
- SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider
- Fixed in
- 7.4.2
- What to do
- Update SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider to 7.4.2 or newer.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML CVE-2014-4846 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php.
- Product
- Meta Slider (ml-slider)
- Affected
- 2.5 to 2.5
- What to do
- Affects 2.5 to 2.5. Update Meta Slider (ml-slider) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Aug 14, 2012Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.CVE-2012-4327 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.
- Product
- Unspecified vulnerability in the Image News slider
- Fixed in
- 3.3
- What to do
- Update Unspecified vulnerability in the Image News slider to 3.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.