Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

317new WordPress flaws this week

393,460entries in the database

9,265 results · page 184 of 186

Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Product
admin/includes/class.import.snippet.php in the "Woody ad snippets
Fixed in
2.2.5
What to do
Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Aug 30, 2019The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.CVE-2019-15833 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
Product
simple-mail-address-encoder
Fixed in
1.7
What to do
Update simple-mail-address-encoder to 1.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.CVE-2019-15821 · WordPress plugins & themes · reported by MITREHigh 7.5
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Product
bold-page-builder
Fixed in
2.3.2
What to do
Update bold-page-builder to 2.3.2 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15819 · WordPress plugins & themes · reported by MITRECritical 9.8
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Product
nd-restaurant-reservations
Fixed in
1.5
What to do
Update nd-restaurant-reservations to 1.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301CVE-2019-15818 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
Product
simple-301-redirects-addon-bulk-uploader
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update simple-301-redirects-addon-bulk-uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 29, 2019The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.CVE-2019-15776 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
Product
simple-301-redirects-addon-bulk-uploader
Fixed in
1.2.5
What to do
Update simple-301-redirects-addon-bulk-uploader to 1.2.5 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 23, 2019The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name,CVE-2019-15092 · WordPress plugins & themes · reported by MITREHigh 7.3
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.CVE-2019-15329 · WordPress plugins & themes · reported by MITREHigh 8.8
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.CVE-2019-15328 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-15327 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
Product
import-users-from-csv-with-meta
Fixed in
1.14.1.3
What to do
Update import-users-from-csv-with-meta to 1.14.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-15326 · WordPress plugins & themes · reported by MITREHigh 7.5
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
Product
import-users-from-csv-with-meta
Fixed in
1.14.2.1
What to do
Update import-users-from-csv-with-meta to 1.14.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.CVE-2017-18577 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
Product
mailchimp-for-wp
Fixed in
4.1.8
What to do
Update mailchimp-for-wp to 4.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-15318 · WordPress plugins & themes · reported by MITRECritical 9.8
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
Product
yikes-inc-easy-mailchimp-extender
Fixed in
6.5.3
What to do
Update yikes-inc-easy-mailchimp-extender to 6.5.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18573 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.4.7 for WordPress has XSS.CVE-2018-20978 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.7
What to do
Update wp-all-import to 3.4.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.4.6 for WordPress has XSS.CVE-2017-18567 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.6
What to do
Update wp-all-import to 3.4.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.CVE-2016-10914 · WordPress plugins & themes · reported by MITREHigh 8.8
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
Product
add-from-server
Fixed in
3.3.2
What to do
Update add-from-server to 3.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Product
wp-all-import
Fixed in
3.2.4
What to do
Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.CVE-2015-9330 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.CVE-2015-9329 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress.CVE-2019-13578 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Product
A SQL injection vulnerability exists in the Impress GiveWP Give
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update A SQL injection vulnerability exists in the Impress GiveWP Give to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Aug 14, 2019The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.CVE-2018-20967 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
Product
wp-ultimate-csv-importer
Fixed in
5.6.1
What to do
Update wp-ultimate-csv-importer to 5.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.CVE-2016-10884 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Product
simple-membership
Fixed in
3.3.3
What to do
Update simple-membership to 3.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.CVE-2016-10883 · WordPress plugins & themes · reported by MITREMedium 6.5
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
Product
simple-add-pages-or-posts
Fixed in
1.7
What to do
Update simple-add-pages-or-posts to 1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.CVE-2013-7476 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
Product
simple-fields
Fixed in
1.2
What to do
Update simple-fields to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18514 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.CVE-2017-18498 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
Product
simple-job-board
Fixed in
2.4.4
What to do
Update simple-job-board to 2.4.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.CVE-2016-10871 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
Product
mailchimp-for-wp
Fixed in
4.0.11
What to do
Update mailchimp-for-wp to 4.0.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The simple-fields plugin before 1.4.11 for WordPress has XSS.CVE-2015-9302 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-fields plugin before 1.4.11 for WordPress has XSS.
Product
simple-fields
Fixed in
1.4.11
What to do
Update simple-fields to 1.4.11 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The simple-membership plugin before 3.5.7 for WordPress has XSS.CVE-2017-18499 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-membership plugin before 3.5.7 for WordPress has XSS.
Product
simple-membership
Fixed in
3.5.7
What to do
Update simple-membership to 3.5.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.CVE-2015-9303 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Product
simple-share-buttons-adder
Fixed in
6.0.0
What to do
Update simple-share-buttons-adder to 6.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.CVE-2019-14948 · WordPress plugins & themes · reported by MITREMedium 5.4
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
Product
woocommerce-product-addon
Fixed in
18.4
What to do
Update woocommerce-product-addon to 18.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.CVE-2015-9306 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
Product
wp-ultimate-csv-importer
Fixed in
3.8.1
What to do
Update wp-ultimate-csv-importer to 3.8.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Product
codection "Import users from CSV with meta
Fixed in
1.14.2.2
What to do
Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 8, 2019core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.CVE-2019-14679 · WordPress plugins & themes · reported by MITREMedium 6.5
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
Product
ARPrice Lite
Affected
2.2 to 2.2
What to do
Affects 2.2 to 2.2. Update ARPrice Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Jul 30, 2019A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.CVE-2019-14327 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
Product
Custom Simple Rss
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Custom Simple Rss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 28, 2019The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.CVE-2019-14328 · WordPress plugins & themes · reported by MITREHigh 8.8
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
Product
Simple Membership
Fixed in
3.8.5
What to do
Update Simple Membership to 3.8.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16259 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16258 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template.CVE-2018-16257 · WordPress plugins & themes · reported by MITREMedium 6.1
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16256 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16255 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16254 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Dec 12, 2018The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.CVE-2018-20101 · WordPress plugins & themes · reported by MITREMedium 6.1
The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.
Product
codection "Import users from CSV with meta
Fixed in
1.12.1
What to do
Update codection "Import users from CSV with meta to 1.12.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Nov 28, 2018A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allowsCVE-2018-19370 · WordPress plugins & themes · reported by MITREMedium 6.6
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
Product
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo)
Fixed in
9.2.0
What to do
Update A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) to 9.2.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Jun 19, 2018The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.CVE-2018-11526 · WordPress plugins & themes · reported by MITREHigh 7.8
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Apr 23, 2018The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks.CVE-2018-10233 · WordPress plugins & themes · reported by MITREHigh 8.8
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin.
Product
User Profile & Membership
Fixed in
2.0.7
What to do
Update User Profile & Membership to 2.0.7 or newer.
Full record and what to do →NVD record github.com wordpress.org
Mar 9, 2018WP All Import plugin prior to version 3.4.7 for: Cross-site scriptingCVE-2018-0547 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP All Import plugin prior to version 3.4.7 for
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update WP All Import plugin prior to version 3.4.7 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Mar 9, 2018WP All Import plugin prior to version 3.4.6 for: Cross-site scriptingCVE-2018-0546 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP All Import plugin prior to version 3.4.6 for
Fixed in
3.4.6
What to do
Update WP All Import plugin prior to version 3.4.6 for to 3.4.6 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.