Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
63 results · page 2 of 2
Apr 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versioCVE-2022-41633 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versions.
- Fixed in
- 6.0.3.0
- What to do
- Update the plugin to 6.0.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 29, 2022Mailchimp for WooCommerce: Has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LANCVE-2022-2556 · WordPress plugins & themes · reported by WPScanLow 2.7
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
- Product
- Mailchimp for WooCommerce
- Fixed in
- 2.7.2
- What to do
- Update Mailchimp for WooCommerce to 2.7.2 or newer.
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not have CSRF check in placeCVE-2021-25072 · WordPress plugins & themes · reported by WPScanMedium 6.5
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.25
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.25 or newer.
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not sanitise and escape logged requests before outputting them in the related admin dashboardCVE-2021-24975 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.24
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.24 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021NextScripts: Social Networks Auto-Poster <= 4.3.20: Reflected Cross-Site ScriptingCVE-2021-38356 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['page'] parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load the page in $_GET['page'] along with malicious JavaScript in $_POST['page'].
- Product
- NextScripts: Social Networks Auto-Poster <= 4.3.20
- Affected
- up to 4.3.20
- What to do
- Affects up to 4.3.20. Update NextScripts: Social Networks Auto-Poster <= 4.3.20 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
- Product
- About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
- Fixed in
- 1.0.7
- What to do
- Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Nov 2, 2020WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.CVE-2020-28033 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Mar 21, 2019The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.CVE-2019-9911 · WordPress plugins & themes · reported by MITREMedium 6.1
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.
- Product
- social-networks-auto-poster-facebook-twitter-g
- Fixed in
- 4.2.8
- What to do
- Update social-networks-auto-poster-facebook-twitter-g to 4.2.8 or newer.
Full record and what to do →NVD recordseclists.orglists.openwall.net
Mar 21, 2019The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key, CVE-2018-20555 · WordPress plugins & themes · reported by MITRECritical 9.8
The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key, and consumer_secret values by reading the dcwp_twitter.php source code. This leads to Twitter account takeover.
- Affected
- 1.7.1 to 1.7.1
- What to do
- Affects 1.7.1 to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 7, 2016the network settings page in WordPress before 4.5: Cross-site scripting (XSS)CVE-2016-6634 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- the network settings page in WordPress before 4.5
- Fixed in
- 4.5
- What to do
- Update the network settings page in WordPress before 4.5 to 4.5 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgdebian.org
Oct 21, 2014Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inCVE-2014-4517 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the searchString parameter.
- Product
- CBI Referral Manager
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update CBI Referral Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Sep 14, 2012wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a nCVE-2012-4422 · WordPress plugins & themes · reported by Red HatLow 3.5
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.
- Fixed in
- 3.4.2
- What to do
- Update the plugin to 3.4.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Apr 21, 2012wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-widCVE-2012-2402 · WordPress plugins & themes · reported by MITREMedium 5.5
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.
- Fixed in
- 3.3.2
- What to do
- Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD recordcore.trac.wordpress.orgosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.