Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

668 results · page 13 of 14

Jun 1, 2021WP Super Cache: Did not properly sanitise its wp_cache_location parameter in its settingsCVE-2021-24329 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue.
Product
WP Super Cache
Fixed in
1.7.3
What to do
Update WP Super Cache to 1.7.3 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super CaCVE-2021-24312 · WordPress plugins & themes · reported by WPScanHigh 7.2
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
Fixed in
1.7.3
What to do
Update the plugin to 1.7.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 5, 2021Contact Form by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24276 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
Product
Contact Form by Supsystic
Fixed in
1.7.15
What to do
Update Contact Form by Supsystic to 1.7.15 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 5, 2021Popup by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24275 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
Product
Popup by Supsystic
Fixed in
1.10.5
What to do
Update Popup by Supsystic to 1.10.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 5, 2021Ultimate Maps by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24274 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
Product
Ultimate Maps by Supsystic
Fixed in
1.2.5
What to do
Update Ultimate Maps by Supsystic to 1.2.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Apr 12, 2021run_action function of the Facebook for: Deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerabilityCVE-2021-24217 · WordPress plugins & themes · reported by WPScanHigh 8.1
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
Product
run_action function of the Facebook for
Fixed in
3.0.0
What to do
Update run_action function of the Facebook for to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021WP Super Cache: Was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location optionCVE-2021-24209 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
Product
WP Super Cache
Fixed in
1.7.2
What to do
Update WP Super Cache to 1.7.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 14, 2020Live Chat - Live support version 3.1.0 and earlier: Cross-site request forgery (CSRF)CVE-2020-5642 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Live Chat - Live support version 3.1.0 and earlier
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Live Chat - Live support version 3.1.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Apr 22, 2020The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions.CVE-2020-12076 · WordPress plugins & themes · reported by MITREHigh 8.8
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.
Product
data-tables-generator-by-supsystic
Fixed in
1.9.92
What to do
Update data-tables-generator-by-supsystic to 1.9.92 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 22, 2020The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.CVE-2020-12075 · WordPress plugins & themes · reported by MITREHigh 8.8
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.
Product
data-tables-generator-by-supsystic
Fixed in
1.9.92
What to do
Update data-tables-generator-by-supsystic to 1.9.92 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 23, 2020An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.CVE-2020-9392 · WordPress plugins & themes · reported by MITREHigh 7.3
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, createFromTpl, and getJSONExportTable endpoints, unauthenticated users can retrieve pricing table information, create new tables, or import/modify a table.
Product
An issue was discovered in the pricing-table-by-supsystic
Fixed in
1.8.2
What to do
Update An issue was discovered in the pricing-table-by-supsystic to 1.8.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 20, 2020The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.CVE-2019-12498 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.
Product
WP Live Chat Support
Fixed in
8.0.33
What to do
Update WP Live Chat Support to 8.0.33 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2020An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.CVE-2020-9394 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.
Product
An issue was discovered in the pricing-table-by-supsystic
Fixed in
1.8.2
What to do
Update An issue was discovered in the pricing-table-by-supsystic to 1.8.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 25, 2020An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.CVE-2020-9393 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.
Product
An issue was discovered in the pricing-table-by-supsystic
Fixed in
1.8.2
What to do
Update An issue was discovered in the pricing-table-by-supsystic to 1.8.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 7, 2020WordPress WP Super Cache Plugin 1.2 has Remote PHP Code ExecutionCVE-2013-2009 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Feb 7, 2020WordPress Super Cache Plugin 1.3 has XSS.CVE-2013-2008 · WordPress plugins & themes · reported by Red HatMedium 6.1
WordPress Super Cache Plugin 1.3 has XSS.
Affected
1.3 to 1.3
What to do
Affects 1.3 to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Jan 9, 2020The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.CVE-2019-20181 · WordPress plugins & themes · reported by MITREMedium 4.8
The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com medium.com
Dec 26, 2019WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code.CVE-2013-2011 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009.
Fixed in
1.3.2
What to do
Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Sep 27, 2019In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full paCVE-2019-16902 · WordPress plugins & themes · reported by MITREHigh 7.5
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.
Product
ARforms
Affected
3.7.1 to 3.7.1
What to do
Affects 3.7.1 to 3.7.1. Update ARforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record almorabea.net arformsplugin.com
Sep 20, 2019The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.CVE-2016-11012 · WordPress plugins & themes · reported by MITREMedium 5.4
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
Product
sola-support-tickets
Fixed in
3.13
What to do
Update sola-support-tickets to 3.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 16, 2019The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.CVE-2016-10970 · WordPress plugins & themes · reported by MITREMedium 6.1
The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.
Product
supportflow
Fixed in
0.7
What to do
Update supportflow to 0.7 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 16, 2019The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.CVE-2016-10969 · WordPress plugins & themes · reported by MITREMedium 6.1
The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.
Product
supportflow
Fixed in
0.7
What to do
Update supportflow to 0.7 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 13, 2019The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.CVE-2016-10947 · WordPress plugins & themes · reported by MITREHigh 7.2
The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
Product
Post Indexer
Fixed in
3.0.6.2
What to do
Update Post Indexer to 3.0.6.2 or newer.
Full record and what to do →NVD record advisories.dxw.com advisories.dxw.com
Aug 29, 2019The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.CVE-2018-21007 · WordPress plugins & themes · reported by MITRECritical 9.8
The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.
Product
woo-confirmation-email
Fixed in
3.2.0
What to do
Update woo-confirmation-email to 3.2.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.CVE-2018-21002 · WordPress plugins & themes · reported by MITREHigh 8.8
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.
Product
js-support-ticket
Fixed in
2.0.6
What to do
Update js-support-ticket to 2.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.CVE-2014-10386 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
Product
wp-live-chat-support
Fixed in
4.1.0
What to do
Update wp-live-chat-support to 4.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.CVE-2019-15331 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.
Product
wp-support-plus-responsive-ticket-system
Fixed in
9.1.2
What to do
Update wp-support-plus-responsive-ticket-system to 9.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.CVE-2016-10930 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
Product
wp-support-plus-responsive-ticket-system
Fixed in
7.1.0
What to do
Update wp-support-plus-responsive-ticket-system to 7.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.CVE-2014-10391 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.1
What to do
Update wp-support-plus-responsive-ticket-system to 4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.CVE-2014-10390 · WordPress plugins & themes · reported by MITRECritical 9.1
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.CVE-2014-10389 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.CVE-2014-10388 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.CVE-2014-10387 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10927 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.11
What to do
Update nelio-ab-testing to 4.5.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10926 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.9
What to do
Update nelio-ab-testing to 4.5.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633CVE-2016-10919 · WordPress plugins & themes · reported by MITREMedium 6.1
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
Product
wassup
Fixed in
1.9.1
What to do
Update wassup to 1.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.CVE-2016-10918 · WordPress plugins & themes · reported by MITREHigh 8.8
The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
Product
gallery-by-supsystic
Fixed in
1.8.6
What to do
Update gallery-by-supsystic to 1.8.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.CVE-2016-10915 · WordPress plugins & themes · reported by MITREHigh 8.8
The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
Product
popup-by-supsystic
Fixed in
1.7.9
What to do
Update popup-by-supsystic to 1.7.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.CVE-2015-9318 · WordPress plugins & themes · reported by MITREHigh 7.5
The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.
Product
awesome-support
Fixed in
3.1.7
What to do
Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.CVE-2015-9317 · WordPress plugins & themes · reported by MITREMedium 6.1
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
Product
awesome-support
Fixed in
3.1.7
What to do
Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.CVE-2017-18512 · WordPress plugins & themes · reported by MITREHigh 8.8
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
Product
newsletter-by-supsystic
Fixed in
1.1.8
What to do
Update newsletter-by-supsystic to 1.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.CVE-2017-18507 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
Product
wp-live-chat-support
Fixed in
7.1.05
What to do
Update wp-live-chat-support to 7.1.05 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.CVE-2019-14950 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
Product
wp-live-chat-support
Fixed in
8.0.27
What to do
Update wp-live-chat-support to 8.0.27 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.CVE-2017-18508 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
Product
wp-live-chat-support
Fixed in
7.1.03
What to do
Update wp-live-chat-support to 7.1.03 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.CVE-2016-10879 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
Product
wp-live-chat-support
Fixed in
6.2.02
What to do
Update wp-live-chat-support to 6.2.02 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jun 3, 2019The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.CVE-2019-11185 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
Product
WP Live Chat Support Pro
Affected
up to 8.0.26
What to do
Affects up to 8.0.26. Update WP Live Chat Support Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wp-livechat.com
Apr 18, 2019An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading CVE-2019-11223 · WordPress plugins & themes · reported by MITRECritical 9.8
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Product
An Unrestricted File Upload Vulnerability in the SupportCandy
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update An Unrestricted File Upload Vulnerability in the SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.kalasag.com.ph wordpress.org
Mar 21, 2019The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.CVE-2019-9913 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.
Product
wp-live-chat-support
Fixed in
8.0.18
What to do
Update wp-live-chat-support to 8.0.18 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Mar 21, 2019A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allCVE-2019-7299 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the subject parameter in wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/ajax/submit_ticket.php.
Product
WP Support Plus Responsive Ticket System
Affected
9.1.1 to 9.1.1
What to do
Affects 9.1.1 to 9.1.1. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.kalasag.com.ph wordpress.org
Oct 18, 2018XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page reCVE-2018-18460 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request.
Affected
8.0.15 to 8.0.15
What to do
Affects 8.0.15 to 8.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.