Updated 34 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

71 results · page 2 of 2

Jan 23, 2023Sitemap: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4545 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Sitemap
Fixed in
4.4
What to do
Update Sitemap to 4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2022Kwayy HTML Sitemap: Does not sanitise and escape some of its settingsCVE-2022-3835 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Kwayy HTML Sitemap
Fixed in
4.0
What to do
Update Kwayy HTML Sitemap to 4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022XML Sitemaps: Does not sanitise and escape a settings before outputting it in the Debug pageCVE-2021-25088 · WordPress plugins & themes · reported by WPScanMedium 4.8
The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
XML Sitemaps
Fixed in
4.1.3
What to do
Update XML Sitemaps to 4.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022XML Sitemap Generator for Google: Does not validate a parameterCVE-2022-0346 · WordPress plugins & themes · reported by WPScanMedium 6.1
The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.
Product
XML Sitemap Generator for Google
Fixed in
2.0.4
What to do
Update XML Sitemap Generator for Google to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Advanced Image Sitemap: Does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin pageCVE-2022-1216 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
Product
Advanced Image Sitemap
Affected
up to 1.2
What to do
Affects up to 1.2. Update Advanced Image Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2022Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or highCVE-2021-36912 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or higher user role.
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 2, 2022Sitemap by click5: Does not have authorisation and CSRF checksCVE-2022-0952 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.
Product
Sitemap by click5
Fixed in
1.0.36
What to do
Update Sitemap by click5 to 1.0.36 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Better WordPress Google XML Sitemaps: Does not sanitise and escape its logsCVE-2022-0230 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
Product
Better WordPress Google XML Sitemaps
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Better WordPress Google XML Sitemaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 24, 2021Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of aCVE-2021-20845 · Other software · XML-Sitemaps · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operation via a specially crafted web page.
Product
Unlimited Sitemap Generator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp xml-sitemaps.com
Nov 1, 2021WP Sitemap Page: Does not properly sanitise and escape some of its settingsCVE-2021-24715 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WP Sitemap Page
Fixed in
1.7.0
What to do
Update WP Sitemap Page to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (iCVE-2021-24192 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Tree Sitemap
Fixed in
2.9
What to do
Update Tree Sitemap to 2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2019The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.CVE-2019-15113 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
Product
companion-sitemap-generator
Fixed in
3.7.0
What to do
Update companion-sitemap-generator to 3.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 9, 2019Google XML Sitemaps Version 4.0.9 and earlier: Cross-site scriptingCVE-2018-16204 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Google XML Sitemaps Version 4.0.9 and earlier
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Google XML Sitemaps Version 4.0.9 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the autheCVE-2014-2675 · WordPress plugins & themes · reported by MITREMedium 6.5
Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete the sitemap via a request to the wp-html-sitemap page in wp-admin/options-general.php.
Product
WP HTML Sitemap
What to do
Update WP HTML Sitemap to the newest version.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Jun 15, 2015Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators fCVE-2015-4353 · Other software · Osscube · reported by MITREMedium 5.8
Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete sitemaps via unspecified vectors.
Product
Custom Sitemap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Oct 3, 2014Cross-site scripting (XSS) vulnerability in the Alphabetic Sitemap (alpha_sitemap) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitCVE-2014-6291 · Other software · Alphabetic Sitemap Project · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Alphabetic Sitemap (alpha_sitemap) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Alphabetic Sitemap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org securityfocus.com
Sep 11, 2014Cross-site scripting (XSS) vulnerability in the Google Sitemap (weeaar_googlesitemap) extension 0.4.3 and earlier for TYPO3 allows remote attackers to inject arCVE-2014-6240 · Computers, phones & browsers · Google Sitemap Project · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Sitemap (weeaar_googlesitemap) extension 0.4.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Google Sitemap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org securityfocus.com
Oct 9, 2009Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6, a module for Drupal, allows remote authenticated users, with CVE-2009-3653 · Other software · Darren OH · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6, a module for Drupal, allows remote authenticated users, with "administer site configuration" permission, to inject arbitrary web script or HTML via unspecified vectors, related to link path output.
Product
XML Sitemap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Jul 28, 2008SQL injection vulnerability in sitemap.xml.php in Camera Life 2.6.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a photos aCVE-2008-3355 · Other software · Camera Life · reported by MITREHigh 7.5
SQL injection vulnerability in sitemap.xml.php in Camera Life 2.6.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a photos action.
Product
Camera Life
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
May 30, 2007Multiple PHP remote file inclusion vulnerabilities in the creator in vBulletin Google Yahoo Site Map (vBGSiteMap) 2.41 for vBulletin allow remote attackers to eCVE-2007-2941 · Other software · Michael Brandon · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in the creator in vBulletin Google Yahoo Site Map (vBGSiteMap) 2.41 for vBulletin allow remote attackers to execute arbitrary PHP code via a URL in the base parameter to (1) vbgsitemap/vbgsitemap-config.php or (2) vbgsitemap/vbgsitemap-vbseo.php.
Product
Vbgsitemap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Jul 21, 2006PHP remote file inclusion vulnerability in sitemap.xml.php in Sitemap component (com_sitemap) 2.0.0 for Mambo 4.5.1 CMS, when register_globals is enabled, allowCVE-2006-3749 · Other software · Mambo · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in sitemap.xml.php in Sitemap component (com_sitemap) 2.0.0 for Mambo 4.5.1 CMS, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Product
Sitemap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.echo.or.id archives.neohapsis.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.