Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
60 results · page 2 of 2
Aug 22, 2019The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.CVE-2018-20988 · WordPress plugins & themes · reported by MITREHigh 7.5
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.
- Product
- wpgform
- Fixed in
- 0.94
- What to do
- Update wpgform to 0.94 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · WordPress plugins & themes · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
- Product
- ninja-forms
- Fixed in
- 3.3.9
- What to do
- Update ninja-forms to 3.3.9 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 15, 2019The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked CVE-2019-14795 · WordPress plugins & themes · reported by MITREMedium 4.8
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jun 13, 2018An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress.CVE-2018-10363 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.
- Product
- WpDevArt "Booking calendar, Appointment Booking System
- Affected
- 2.2.2 to 2.2.2
- What to do
- Affects 2.2.2 to 2.2.2. Update WpDevArt "Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 4, 2018lib/interface.php of the Relevanssi plugin 4.0.4 for: Cross-site scripting (XSS)CVE-2018-9034 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the tab GET parameter.
- Product
- lib/interface.php of the Relevanssi plugin 4.0.4 for
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update lib/interface.php of the Relevanssi plugin 4.0.4 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 17, 2017Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers CVE-2015-7806 · WordPress plugins & themes · reported by MITRECritical 9.8
Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors.
- Product
- Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager
- Fixed in
- 1.7.3
- What to do
- Update Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager to 1.7.3 or newer.
Full record and what to do →NVD recordappcheck-ng.complugins.trac.wordpress.org
Jul 17, 2017WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected siteCVE-2017-1000038 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site
- Affected
- 3.5.7.1 to 3.5.7.1
- What to do
- Affects 3.5.7.1 to 3.5.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurity.dxw.comsecurity.dxw.com
Jan 2, 2015Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2014-9443 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Cross-site scripting (XSS) vulnerability in the Relevanssi
- Fixed in
- 3.3.8
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Relevanssi to 3.3.8 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Feb 28, 2008modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for: Eval injectionCVE-2008-1060 · WordPress plugins & themes · reported by MITREHigh 7.5
Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text parameter.
- Product
- modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for
- What to do
- Update modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for to the newest version.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Jul 5, 2005PEAR XML_RPC 1.3.0 and earlier: Eval injectionCVE-2005-1921 · WordPress plugins & themes · reported by Red HatHigh 7.5
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
- Product
- PEAR XML_RPC 1.3.0 and earlier
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update PEAR XML_RPC 1.3.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.