Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,156 results · page 16 of 24

Nov 2, 2019An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator.CVE-2019-18668 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price.
Fixed in
2.11.2
What to do
Update the plugin to 2.11.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 22, 2019The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.CVE-2015-9497 · WordPress plugins & themes · reported by MITREHigh 8.8
The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.
Product
ad-inserter
Fixed in
1.5.3
What to do
Update ad-inserter to 1.5.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Oct 18, 2019A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress.CVE-2019-17207 · WordPress plugins & themes · reported by MITREMedium 5.4
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.
Product
broken-link-checker (aka Broken Link Checker)
Affected
up to 1.11.8
What to do
Affects up to 1.11.8. Update broken-link-checker (aka Broken Link Checker) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 17, 2019WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.CVE-2019-17675 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org core.trac.wordpress.org
Oct 10, 2019The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.CVE-2015-9471 · WordPress plugins & themes · reported by MITRECritical 9.8
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.
Product
dzs-zoomsounds
Affected
up to 2.0
What to do
Affects up to 2.0. Update dzs-zoomsounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Oct 10, 2019The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.CVE-2015-9459 · WordPress plugins & themes · reported by MITREMedium 6.1
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
Product
searchterms-tagging-2
Affected
up to 1.535
What to do
Affects up to 1.535. Update searchterms-tagging-2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbCVE-2015-9456 · WordPress plugins & themes · reported by MITREMedium 6.5
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.
Product
orbisius-child-theme-creator
Fixed in
1.2.8
What to do
Update orbisius-child-theme-creator to 1.2.8 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parametCVE-2015-9455 · WordPress plugins & themes · reported by MITREHigh 8.1
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
Product
buddypress-activity-plus
Fixed in
1.6.2
What to do
Update buddypress-activity-plus to 1.6.2 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Oct 7, 2019The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.CVE-2015-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
Product
smooth-slider
Fixed in
2.7
What to do
Update smooth-slider to 2.7 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.CVE-2015-9452 · WordPress plugins & themes · reported by MITRECritical 9.8
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
Product
nex-forms-express-wp-form-builder
Fixed in
4.6.1
What to do
Update nex-forms-express-wp-form-builder to 4.6.1 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameCVE-2015-9451 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.CVE-2015-9450 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.CVE-2018-18379 · WordPress plugins & themes · reported by MITREMedium 6.1
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.
Product
elementor-edit-template class in wp-admin/customize.php in the Elementor Pro
Fixed in
2.0.10
What to do
Update elementor-edit-template class in wp-admin/customize.php in the Elementor Pro to 2.0.10 or newer.
Full record and what to do →NVD record elementor.com contextis.com
Oct 3, 2019A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or otheCVE-2019-16931 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
Product
Visualizer
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Visualizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record nathandavison.com wordpress.org
Sep 26, 2019The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.CVE-2015-9448 · WordPress plugins & themes · reported by MITREHigh 8.8
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.
Product
sendpress
Fixed in
1.2
What to do
Update sendpress to 1.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.CVE-2015-9447 · WordPress plugins & themes · reported by MITREMedium 6.5
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.CVE-2015-9446 · WordPress plugins & themes · reported by MITREHigh 8.8
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.CVE-2015-9445 · WordPress plugins & themes · reported by MITREHigh 8.8
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.CVE-2015-9443 · WordPress plugins & themes · reported by MITREMedium 6.5
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.CVE-2015-9442 · WordPress plugins & themes · reported by MITREMedium 6.5
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.CVE-2015-9441 · WordPress plugins & themes · reported by MITREMedium 6.5
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
Affected
2.9.2 to 2.9.2
What to do
Affects 2.9.2 to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.CVE-2015-9440 · WordPress plugins & themes · reported by MITREMedium 6.5
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
Product
monetize
Affected
up to 1.03
What to do
Affects up to 1.03. Update monetize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.CVE-2015-9439 · WordPress plugins & themes · reported by MITREMedium 4.8
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
Product
addthis
Fixed in
5.0.13
What to do
Update addthis to 5.0.13 or newer.
Full record and what to do →NVD record blog.cinu.pl wordpress.org
Sep 25, 2019The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameterCVE-2015-9438 · WordPress plugins & themes · reported by MITREMedium 5.4
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Product
display-widgets
Fixed in
2.04
What to do
Update display-widgets to 2.04 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.CVE-2015-9437 · WordPress plugins & themes · reported by MITREMedium 6.5
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Product
dynamic-widgets
Fixed in
1.5.11
What to do
Update dynamic-widgets to 1.5.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.CVE-2015-9436 · WordPress plugins & themes · reported by MITREMedium 5.4
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.
Product
dynamic-widgets
Fixed in
1.5.11
What to do
Update dynamic-widgets to 1.5.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or taCVE-2015-9434 · WordPress plugins & themes · reported by MITREMedium 6.5
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Product
kiwi-logo-carousel
Fixed in
1.7.2
What to do
Update kiwi-logo-carousel to 1.7.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-CVE-2015-9432 · WordPress plugins & themes · reported by MITREMedium 6.5
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Product
alpine-photo-tile-for-instagram
Fixed in
1.2.7.6
What to do
Update alpine-photo-tile-for-instagram to 1.2.7.6 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_CVE-2015-9431 · WordPress plugins & themes · reported by MITREMedium 6.5
The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.
Product
qtranslate-x
Fixed in
3.4.4
What to do
Update qtranslate-x to 3.4.4 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.CVE-2015-9449 · WordPress plugins & themes · reported by MITREHigh 7.2
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Product
microblog-poster
Fixed in
1.6.2
What to do
Update microblog-poster to 1.6.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameCVE-2015-9429 · WordPress plugins & themes · reported by MITREMedium 6.5
The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
Product
yith-maintenance-mode
Fixed in
1.2.0
What to do
Update yith-maintenance-mode to 1.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone,CVE-2015-9428 · WordPress plugins & themes · reported by MITREMedium 6.5
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.
Product
wplegalpages
Fixed in
1.1
What to do
Update wplegalpages to 1.1 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.CVE-2015-9427 · WordPress plugins & themes · reported by MITREMedium 6.5
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
Product
googmonify
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update googmonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.CVE-2015-9426 · WordPress plugins & themes · reported by MITREMedium 4.6
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
Product
manual-image-crop
Fixed in
1.11
What to do
Update manual-image-crop to 1.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallockeCVE-2015-9425 · WordPress plugins & themes · reported by MITREMedium 5.4
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.
Product
social-locker
Fixed in
4.2.5
What to do
Update social-locker to 4.2.5 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admiCVE-2015-9424 · WordPress plugins & themes · reported by MITREMedium 6.5
The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
Product
multicons
Fixed in
3.0
What to do
Update multicons to 3.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGCVE-2015-9423 · WordPress plugins & themes · reported by MITREMedium 5.4
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters.
Product
PlugNedit Adaptive Editor
Fixed in
6.2.0
What to do
Update PlugNedit Adaptive Editor to 6.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_diaCVE-2015-9422 · WordPress plugins & themes · reported by MITREMedium 6.5
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters.
Product
PlugNedit Adaptive Editor
Fixed in
6.2.0
What to do
Update PlugNedit Adaptive Editor to 6.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.CVE-2015-9421 · WordPress plugins & themes · reported by MITREMedium 6.5
The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
Product
olevmedia-shortcodes
Fixed in
1.1.9
What to do
Update olevmedia-shortcodes to 1.1.9 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.CVE-2015-9420 · WordPress plugins & themes · reported by MITREMedium 6.1
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
Product
soundcloud-is-gold
Fixed in
2.3.2
What to do
Update soundcloud-is-gold to 2.3.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.CVE-2015-9413 · WordPress plugins & themes · reported by MITREMedium 6.5
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Product
eshop
Affected
up to 6.3.13
What to do
Affects up to 6.3.13. Update eshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.CVE-2015-9409 · WordPress plugins & themes · reported by MITREMedium 6.5
The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.
Product
alo-easymail
Fixed in
2.6.01
What to do
Update alo-easymail to 2.6.01 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.CVE-2015-9408 · WordPress plugins & themes · reported by MITREMedium 6.5
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
Product
xpinner-lite
Affected
up to 2.2
What to do
Affects up to 2.2. Update xpinner-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.CVE-2015-9401 · WordPress plugins & themes · reported by MITREMedium 4.8
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
Product
websimon-tables
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update websimon-tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.CVE-2015-9400 · WordPress plugins & themes · reported by MITREHigh 8.8
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
Product
wordpress-meta-robots
Affected
up to 2.1
What to do
Affects up to 2.1. Update wordpress-meta-robots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.CVE-2015-9399 · WordPress plugins & themes · reported by MITREHigh 7.2
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
Product
wp-stats-dashboard
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update wp-stats-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.CVE-2015-9398 · WordPress plugins & themes · reported by MITREHigh 8.8
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
Product
gocodes
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update gocodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.CVE-2015-9397 · WordPress plugins & themes · reported by MITREMedium 5.4
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Product
gocodes
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update gocodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.CVE-2015-9394 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.CVE-2016-11012 · WordPress plugins & themes · reported by MITREMedium 5.4
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
Product
sola-support-tickets
Fixed in
3.13
What to do
Update sola-support-tickets to 3.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.