Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

9,148 results · page 180 of 183

Sep 17, 2018The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.CVE-2018-17140 · WordPress plugins & themes · reported by MITREMedium 5.4
The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.
Product
Quizlord
Affected
up to 2.0
What to do
Affects up to 2.0. Update Quizlord to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 17, 2018The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.CVE-2018-17138 · WordPress plugins & themes · reported by MITREMedium 5.4
The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.
Product
Jibu Pro
Affected
up to 1.7
What to do
Affects up to 1.7. Update Jibu Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Aug 26, 2018Plainview Activity Monitor plugin before 20180826: OS command injectionCVE-2018-15877 · WordPress plugins & themes · reported by MITREHigh 8.8
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request.
Product
Plainview Activity Monitor plugin before 20180826
Fixed in
20180826
What to do
Update Plainview Activity Monitor plugin before 20180826 to 20180826 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 16, 2018The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input.CVE-2018-14071 · WordPress plugins & themes · reported by MITRECritical 9.8
The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input.
Product
Geo Mashup
Fixed in
1.10.4
What to do
Update Geo Mashup to 1.10.4 or newer.
Full record and what to do →NVD record github.com github.com
Jun 26, 2018WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passeCVE-2018-12895 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.
Affected
up to 4.9.6
What to do
Affects up to 4.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 1, 2018MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier: Stored XSSCVE-2018-11485 · WordPress plugins & themes · reported by MITREMedium 6.1
The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack is possible by modifying the "referral_site" cookie to have an XSS payload, and placing an order.
Product
MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com labs.threatpress.com
May 30, 2018An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress.CVE-2018-11580 · WordPress plugins & themes · reported by MITREMedium 5.4
An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.
Product
MULTIDOTS Mass Pages/Posts Creator
Affected
1.2.2 to 1.2.2
What to do
Affects 1.2.2 to 1.2.2. Update MULTIDOTS Mass Pages/Posts Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com wordpress.org
May 22, 2018init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled.CVE-2018-11366 · WordPress plugins & themes · reported by MITREMedium 6.1
init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled. This is fixed in 1.4.0.
Product
init.php in the Loginizer plugin 1.3.8
Affected
up to 1.3.9
Fixed in
1.4.0
What to do
Update init.php in the Loginizer plugin 1.3.8 to 1.4.0 or newer.
Full record and what to do →NVD record blog.dewhurstsecurity.com plugins.trac.wordpress.org
May 18, 2018The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor.CVE-2018-11244 · WordPress plugins & themes · reported by MITREMedium 5.3
The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor.
Product
BBE
Fixed in
1.53
What to do
Update BBE to 1.53 or newer.
Full record and what to do →NVD record wpvulndb.com dopewp.com
May 15, 2018There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) CVE-2018-11105 · WordPress plugins & themes · reported by MITREMedium 6.1
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.
Product
There is stored cross site scripting in the wp-live-chat-support
Fixed in
8.0.08
What to do
Update There is stored cross site scripting in the wp-live-chat-support to 8.0.08 or newer.
Full record and what to do →NVD record github.com wordpress.org
May 14, 2018the AJAX function of Ultimate Member plugin prior to version 2.0.4 for: Directory traversalCVE-2018-0588 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.
Product
the AJAX function of Ultimate Member plugin prior to version 2.0.4 for
Fixed in
2.0.4
What to do
Update the AJAX function of Ultimate Member plugin prior to version 2.0.4 for to 2.0.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 14, 2018the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for: Directory traversalCVE-2018-0586 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors.
Product
the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for
Fixed in
2.0.4
What to do
Update the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for to 2.0.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 4, 2018The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.CVE-2018-10752 · WordPress plugins & themes · reported by MITREMedium 4.8
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
Affected
0.6 to 0.6
What to do
Affects 0.6 to 0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pastebin.com exploit-db.com
Apr 25, 2018The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters iCVE-2014-5014 · WordPress plugins & themes · reported by MITRECritical 9.8
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
Product
WordPress Flash Uploader
Fixed in
3.1.3
What to do
Update WordPress Flash Uploader to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 16, 2018Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.CVE-2018-10102 · WordPress plugins & themes · reported by MITREMedium 6.1
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Apr 16, 2018Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.CVE-2018-10101 · WordPress plugins & themes · reported by MITREMedium 6.1
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Apr 12, 2018exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a ..CVE-2018-9118 · WordPress plugins & themes · reported by MITREHigh 7.5
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter.
Product
exports/download.php in the 99 Robots WP Background Takeover Advertisements
Fixed in
4.1.5
What to do
Update exports/download.php in the 99 Robots WP Background Takeover Advertisements to 4.1.5 or newer.
Full record and what to do →NVD record 99robots.com wpvulndb.com
Apr 9, 2018The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.CVE-2018-9864 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.
Product
WP Live Chat Support
Fixed in
8.0.06
What to do
Update WP Live Chat Support to 8.0.06 or newer.
Full record and what to do →NVD record wordpress.org gubello.me
Mar 26, 2018installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for: Cross-site scripting (XSS)CVE-2018-7543 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter.
Product
installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for
Affected
1.2.32 to 1.2.32
What to do
Affects 1.2.32 to 1.2.32. Update installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record snapcreek.com exploit-db.com
Mar 19, 2018Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2014-2674 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the loop parameter in an ajax_navigation action to wp-admin/admin-ajax.php.
Product
Ajax Pagination (twitter Style)
Affected
1.1 to 1.1
What to do
Affects 1.1 to 1.1. Update Ajax Pagination (twitter Style) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Mar 19, 2018A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_pathCVE-2018-7422 · WordPress plugins & themes · reported by MITREHigh 7.5
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
Product
A Local File Inclusion vulnerability in the Site Editor
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update A Local File Inclusion vulnerability in the Site Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wpvulndb.com
Jan 30, 2018admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, CVE-2018-6195 · WordPress plugins & themes · reported by MITREHigh 7.2
admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.
Product
admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images)
Fixed in
2.1.1
What to do
Update admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) to 2.1.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 12, 2018The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.CVE-2018-5369 · WordPress plugins & themes · reported by MITREMedium 4.8
The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.
Affected
1.46 to 1.46
What to do
Affects 1.46 to 1.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.CVE-2018-5365 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 9, 2018In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-seaCVE-2018-5310 · WordPress plugins & themes · reported by MITREMedium 6.5
In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI.
Product
In the "Media from FTP
Fixed in
9.85
What to do
Update In the "Media from FTP to 9.85 or newer.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.CVE-2018-5291 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.CVE-2018-5290 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.CVE-2018-5289 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.CVE-2018-5287 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.phCVE-2018-5213 · WordPress plugins & themes · reported by MITREMedium 5.4
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
Product
Simple Download Monitor
Fixed in
3.5.4
What to do
Update Simple Download Monitor to 3.5.4 or newer.
Full record and what to do →NVD record github.com github.com
Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/CVE-2018-5212 · WordPress plugins & themes · reported by MITREMedium 5.4
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.
Product
Simple Download Monitor
Fixed in
3.5.4
What to do
Update Simple Download Monitor to 3.5.4 or newer.
Full record and what to do →NVD record github.com github.com
Dec 27, 2017Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPreCVE-2015-7669 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to "upload file functionality."
Fixed in
1.3.0
What to do
Update the plugin to 1.3.0 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Nov 29, 2017The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, whicCVE-2017-17058 · WordPress plugins & themes · reported by MITREHigh 7.5
The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template files have "if (!defined('ABSPATH')) {exit;}" code
Product
WooCommerce
Affected
up to 3.x
What to do
Affects up to 3.x. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com exploit-db.com
Nov 28, 2017The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templCVE-2017-17043 · WordPress plugins & themes · reported by MITREMedium 6.1
The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Nov 17, 2017Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin canCVE-2017-1000227 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can
Affected
3.0.15 to 3.0.15
What to do
Affects 3.0.15 to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record security.dxw.com wpvulndb.com
Nov 17, 2017TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.CVE-2017-10889 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.
Affected
up to 1.8
What to do
Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Nov 14, 2017installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-contCVE-2017-16815 · WordPress plugins & themes · reported by MITREMedium 6.1
installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-content/plugins/duplicator/installer/build/view.step4.php) and "logging" (wp-content/plugins/duplicator/installer/build/view.step2.php) are not filtered correctly.
Product
installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup)
Fixed in
1.2.30
What to do
Update installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) to 1.2.30 or newer.
Full record and what to do →NVD record packetstormsecurity.com snapcreek.com
Oct 24, 2017Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web CVE-2017-15867 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, (3) user_id, (4) username, (5) country_name, (6) browser, (7) operating_system, or (8) ip_address parameter to admin/partials/listing/listing.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Oct 23, 2017SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute CVE-2015-5533 · WordPress plugins & themes · reported by MITREHigh 7.2
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpd_keep_month parameter to wp-admin/options-general.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Product
SQL injection vulnerability in counter-options.php in the Count Per Day
Fixed in
3.4.1
What to do
Update SQL injection vulnerability in counter-options.php in the Count Per Day to 3.4.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 19, 2017The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, reCVE-2015-6668 · WordPress plugins & themes · reported by MITREHigh 7.5
The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.
Product
Job Manager
Fixed in
0.7.25
What to do
Update Job Manager to 0.7.25 or newer.
Full record and what to do →NVD record vagmour.eu wpvulndb.com
Oct 16, 2017SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_custCVE-2014-8621 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_custom_field parameter to sl-xml.php.
Product
SQL injection vulnerability in the Store Locator plugin 2.3
Affected
up to 3.11
What to do
Affects up to 3.11. Update SQL injection vulnerability in the Store Locator plugin 2.3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record g0blin.co.uk wpvulndb.com
Oct 6, 2017The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.CVE-2017-15079 · WordPress plugins & themes · reported by MITREHigh 7.5
The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.
Product
Smush Image Compression and Optimization
Fixed in
2.7.6
What to do
Update Smush Image Compression and Optimization to 2.7.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Oct 2, 2017WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it CVE-2017-14990 · WordPress plugins & themes · reported by MITREMedium 6.5
WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securitytracker.com core.trac.wordpress.org
Sep 27, 2017Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrCVE-2017-14622 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store
Fixed in
2.1.1
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store to 2.1.1 or newer.
Full record and what to do →NVD record securityfocus.com packetstormsecurity.com
Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.CVE-2017-14726 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 23, 2017Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.CVE-2017-14722 · WordPress plugins & themes · reported by MITREHigh 7.5
Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 23, 2017Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.CVE-2017-14721 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.CVE-2017-14719 · WordPress plugins & themes · reported by MITREHigh 7.5
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 14, 2017Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.CVE-2017-1002017 · WordPress plugins & themes · reported by larry0@me.comMedium 6.1
Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_descCVE-2017-1002011 · WordPress plugins & themes · reported by larry0@me.comMedium 5.4
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database.
Affected
1.5.2 to 1.5.2
What to do
Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.