Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
979 results · page 19 of 20
Apr 12, 2021Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon: The WordPress login form (wp-loginCVE-2021-24228 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized.
- Product
- Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon
- Fixed in
- 1.7.2
- What to do
- Update Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon to 1.7.2 or newer.
Apr 12, 2021GiveWP – Donation Plugin and Fundraising Platform: Was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panelCVE-2021-24213 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.0
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.0 or newer.
Apr 5, 2021Social Slider Widget: Allowed Authenticated Reflected XSS in the plugin settings pageCVE-2021-24196 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
- Product
- Social Slider Widget
- Fixed in
- 1.8.5
- What to do
- Update Social Slider Widget to 1.8.5 or newer.
Full record and what to do →NVD recordpurinechu.github.iowpscan.com
Apr 5, 2021setting page of the SEO Redirection Plugin - 301 Redirect Manager: Is vulnerable to reflected Cross-Site Scripting (XSS)CVE-2021-24187 · WordPress plugins & themes · reported by WPScanMedium 5.4
The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute.
- Product
- setting page of the SEO Redirection Plugin - 301 Redirect Manager
- Fixed in
- 6.4
- What to do
- Update setting page of the SEO Redirection Plugin - 301 Redirect Manager to 6.4 or newer.
Apr 5, 2021Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerabCVE-2021-24180 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.
- Fixed in
- 2.0.4
- What to do
- Update the plugin to 2.0.4 or newer.
Apr 5, 2021In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_managerCVE-2021-24177 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
- Product
- File Manager
- Fixed in
- 7.1
- What to do
- Update File Manager to 7.1 or newer.
Full record and what to do →NVD recordn4nj0.github.ioplugins.trac.wordpress.org
Apr 5, 2021The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.CVE-2021-24152 · WordPress plugins & themes · reported by WPScanMedium 6.1
The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.
- Fixed in
- 3.74
- What to do
- Update the plugin to 3.74 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site ScriptCVE-2021-24124 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation.
- Product
- WP Shieldon
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update WP Shieldon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2020A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victimCVE-2020-35933 · WordPress plugins & themes · reported by MITREMedium 6.5
A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.
- Product
- A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter
- Fixed in
- 6.8.2
- What to do
- Update A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Aug 31, 2020The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.CVE-2020-25033 · WordPress plugins & themes · reported by MITREMedium 6.1
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
- Affected
- 1.3.1 to 1.3.1
- What to do
- Affects 1.3.1 to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgzeroaptitude.com
Aug 12, 2020search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.CVE-2020-17362 · WordPress plugins & themes · reported by MITREMedium 6.1
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
- Product
- search.php in the Nova Lite
- Fixed in
- 1.3.9
- What to do
- Update search.php in the Nova Lite to 1.3.9 or newer.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Jul 9, 2020A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submiCVE-2020-15299 · WordPress plugins & themes · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is executed in the victim's browser.
- Product
- A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.CVE-2020-15364 · WordPress plugins & themes · reported by MITREMedium 6.1
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
- Product
- Nexos
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 10, 2020The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.CVE-2020-14010 · WordPress plugins & themes · reported by MITREMedium 6.1
The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.
- Affected
- 1.3 to 1.3
- What to do
- Affects 1.3 to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordknassar702.github.ioknassar702.github.io
Jun 2, 2020The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective SerCVE-2019-11843 · WordPress plugins & themes · reported by MITREMedium 6.1
The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).
- Product
- MailPoet
- Fixed in
- 3.23.2
- What to do
- Update MailPoet to 3.23.2 or newer.
Full record and what to do →NVD recordgithub.compluginarchive.com
Apr 23, 2020The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query).CVE-2020-12054 · WordPress plugins & themes · reported by MITREMedium 6.1
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.
- Product
- Catch Breadcrumb
- Fixed in
- 1.5.4
- What to do
- Update Catch Breadcrumb to 1.5.4 or newer.
Full record and what to do →NVD recordcxsecurity.comwpvulndb.com
Apr 19, 2020The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link.CVE-2020-11930 · WordPress plugins & themes · reported by MITREMedium 6.1
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.
- Product
- GTranslate
- Fixed in
- 2.8.52
- What to do
- Update GTranslate to 2.8.52 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 28, 2020The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page.CVE-2020-8426 · WordPress plugins & themes · reported by MITREMedium 5.4
The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.
- Product
- Elementor
- Fixed in
- 2.8.5
- What to do
- Update Elementor to 2.8.5 or newer.
Full record and what to do →NVD recordblog.impenetrable.techwordpress.org
Jan 17, 2020The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.CVE-2020-7104 · WordPress plugins & themes · reported by MITREMedium 6.1
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.
- Affected
- 1.1.8.1 to 1.1.8.1
- What to do
- Affects 1.1.8.1 to 1.1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Jan 13, 2020The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.CVE-2019-20210 · WordPress plugins & themes · reported by MITREMedium 6.1
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.
- Fixed in
- 2.3.4
- What to do
- Update the plugin to 2.3.4 or newer.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Dec 26, 2019The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.CVE-2019-19540 · WordPress plugins & themes · reported by MITREMedium 6.1
The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.
- Product
- ListingPro
- Fixed in
- 2.0.14.2
- What to do
- Update ListingPro to 2.0.14.2 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Dec 4, 2019The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanCVE-2019-19133 · WordPress plugins & themes · reported by MITREMedium 6.1
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.
- Product
- CSS Hero
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update CSS Hero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 18, 2019A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress.CVE-2019-17207 · WordPress plugins & themes · reported by MITREMedium 5.4
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.
- Product
- broken-link-checker (aka Broken Link Checker)
- Affected
- up to 1.11.8
- What to do
- Affects up to 1.11.8. Update broken-link-checker (aka Broken Link Checker) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 16, 2019The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of CVE-2019-16521 · WordPress plugins & themes · reported by MITREMedium 6.1
The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_id=search request. NOTE: this is an end-of-life product.
- Product
- broken-link-checker
- Affected
- up to 1.11.8
- What to do
- Affects up to 1.11.8. Update broken-link-checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 17, 2019The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.CVE-2016-10975 · WordPress plugins & themes · reported by MITREMedium 6.1
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
- Product
- fluid-responsive-slideshow
- Fixed in
- 2.2.7
- What to do
- Update fluid-responsive-slideshow to 2.2.7 or newer.
Full record and what to do →NVD recordklikki.fiwordpress.org
Sep 11, 2019WordPress before 5.2.3 allows reflected XSS in the dashboard.CVE-2019-16221 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows reflected XSS in the dashboard.
- Fixed in
- 5.2.3
- What to do
- Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD recordlists.debian.orgseclists.org
Aug 30, 2019The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.CVE-2019-15838 · WordPress plugins & themes · reported by MITREMedium 6.1
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.
- Product
- custom-404-pro
- Fixed in
- 3.2.8
- What to do
- Update custom-404-pro to 3.2.8 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 30, 2019The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.CVE-2019-15833 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
- Product
- simple-mail-address-encoder
- Fixed in
- 1.7
- What to do
- Update simple-mail-address-encoder to 1.7 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 27, 2019The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.CVE-2015-9350 · WordPress plugins & themes · reported by MITREMedium 6.1
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
- Product
- feed-them-social
- Fixed in
- 1.7.0
- What to do
- Update feed-them-social to 1.7.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 27, 2019The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.CVE-2015-9349 · WordPress plugins & themes · reported by MITREMedium 6.1
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
- Product
- ckeditor-for-wordpress
- Fixed in
- 4.5.3.1
- What to do
- Update ckeditor-for-wordpress to 4.5.3.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The clean-login plugin before 1.5.1 for WordPress has reflected XSS.CVE-2015-9336 · WordPress plugins & themes · reported by MITREMedium 6.1
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
- Product
- clean-login
- Fixed in
- 1.5.1
- What to do
- Update clean-login to 1.5.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.CVE-2017-18534 · WordPress plugins & themes · reported by MITREMedium 6.1
The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
- Product
- share-on-diaspora
- Fixed in
- 0.7.2
- What to do
- Update share-on-diaspora to 0.7.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.CVE-2015-9329 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
- Product
- wp-all-import
- Fixed in
- 3.2.5
- What to do
- Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.CVE-2019-15082 · WordPress plugins & themes · reported by MITREMedium 6.1
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.
- Product
- 360-product-rotation
- Fixed in
- 1.4.8
- What to do
- Update 360-product-rotation to 1.4.8 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 14, 2019The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.CVE-2015-9311 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
- Product
- newstatpress
- Fixed in
- 1.0.6
- What to do
- Update newstatpress to 1.0.6 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 13, 2019The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.CVE-2017-18498 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
- Product
- simple-job-board
- Fixed in
- 2.4.4
- What to do
- Update simple-job-board to 2.4.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002009 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email variable.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002008 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variable.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002007 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002004 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002003 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002002 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002001 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Jun 4, 2018wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site ScriptinCVE-2018-11709 · WordPress plugins & themes · reported by MITREMedium 6.1
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI.
- Product
- wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum
- Fixed in
- 1.4.12
- What to do
- Update wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum to 1.4.12 or newer.
Full record and what to do →NVD recordblog.dewhurstsecurity.comwordpress.org
May 30, 2018Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter.CVE-2018-11568 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the '<' and '>' characters have < and > representations.
- Product
- Reflected XSS is possible in the GamePlan
- Affected
- up to 1.5.13.2
- What to do
- Affects up to 1.5.13.2. Update Reflected XSS is possible in the GamePlan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 28, 2017The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templCVE-2017-17043 · WordPress plugins & themes · reported by MITREMedium 6.1
The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Jul 17, 2017Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in CVE-2017-1000033 · WordPress plugins & themes · reported by MITREMedium 6.1
Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2017Raygun4WP plugin 1.8.0: A reflected XSS in sendtesterrorCVE-2017-9288 · WordPress plugins & themes · reported by MITREMedium 6.1
The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).
- Product
- Raygun4WP plugin 1.8.0
- Affected
- 1.8.0 to 1.8.0
- What to do
- Affects 1.8.0 to 1.8.0. Update Raygun4WP plugin 1.8.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordjgj212.blogspot.krgithub.com
Oct 10, 2016Reflected XSS in wordpress plugin wpsolr-search-engine v7.6CVE-2016-1000155 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin wpsolr-search-engine v7.6
- Affected
- 7.6 to 7.6
- What to do
- Affects 7.6 to 7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin whizz v1.0.7CVE-2016-1000154 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin whizz v1.0.7
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.