Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

75 results · page 2 of 2

Sep 25, 2019The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.CVE-2015-9416 · WordPress plugins & themes · reported by MITREMedium 6.1
The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.
Affected
2.9.3 to 3.2.6
What to do
Affects 2.9.3 to 3.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 17, 2019The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.CVE-2016-10990 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
Product
wp-cerber
Fixed in
2.7
What to do
Update wp-cerber to 2.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 16, 2019The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.CVE-2016-10964 · WordPress plugins & themes · reported by MITREMedium 6.1
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.
Product
dwnldr
Fixed in
1.01
What to do
Update dwnldr to 1.01 or newer.
Full record and what to do →NVD record rastating.github.io wordpress.org
Aug 27, 2019The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.CVE-2015-9345 · WordPress plugins & themes · reported by MITREHigh 7.5
The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
Product
link-log
Fixed in
2.0
What to do
Update link-log to 2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictiCVE-2018-20149 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Product
wp-slimstat (aka Slimstat Analytics)
Fixed in
4.1.6.1
What to do
Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Jul 13, 2018The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, CVE-2016-6565 · WordPress plugins & themes · reported by cret@cert.orgHigh 7.5
The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).
Fixed in
2.1.57
What to do
Update the plugin to 2.1.57 or newer.
Full record and what to do →NVD record kb.cert.org securityfocus.com
Apr 16, 2018Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.CVE-2018-10100 · WordPress plugins & themes · reported by MITREMedium 6.1
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securitytracker.com codex.wordpress.org
Nov 17, 2017The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget sCVE-2017-16870 · WordPress plugins & themes · reported by MITREHigh 8.1
The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary
Product
UpdraftPlus
Affected
up to 1.13.12
What to do
Affects up to 1.13.12. Update UpdraftPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Sep 14, 2017Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invediCVE-2017-1002003 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/CVE-2017-1002002 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.CVE-2017-1002001 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.
Affected
1.05 to 1.05
What to do
Affects 1.05 to 1.05. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Aug 7, 2017SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header.CVE-2017-12650 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header.
Product
SQL Injection exists in the Loginizer
Fixed in
1.3.6
What to do
Update SQL Injection exists in the Loginizer to 1.3.6 or newer.
Full record and what to do →NVD record blog.wpscans.com sv.wordpress.org
Jul 21, 2017The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which aCVE-2015-3421 · WordPress plugins & themes · reported by MITREMedium 6.1
The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.
Affected
up to 6.3.11
What to do
Affects up to 6.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com htbridge.com
May 18, 2017In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.CVE-2017-9066 · WordPress plugins & themes · reported by MITREHigh 8.6
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
May 4, 2017WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwoCVE-2017-8295 · WordPress plugins & themes · reported by MITREMedium 5.9
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.
Affected
up to 4.7.4
What to do
Affects up to 4.7.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record debian.org securityfocus.com
May 21, 2016The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attackCVE-2016-2222 · WordPress plugins & themes · reported by security@debian.orgHigh 8.6
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
Fixed in
4.4.2
What to do
Update the plugin to 4.4.2 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Sep 16, 2015The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloCVE-2015-6828 · WordPress plugins & themes · reported by MITREMedium 6.8
The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by modifying the client-server data stream. NOTE: some of these details are obtained from third party information.
Product
SecureMoz Security Audit
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update SecureMoz Security Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Nov 25, 2014wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side requCVE-2014-9038 · WordPress plugins & themes · reported by MITREMedium 6.4
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.
Fixed in
3.7.5
What to do
Update the plugin to 3.7.5 or newer.
Full record and what to do →NVD record advisories.mageia.org openwall.com
Sep 12, 2013WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictionsCVE-2013-4339 · WordPress plugins & themes · reported by Red HatHigh 7.5
WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.
Fixed in
3.6.1
What to do
Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jul 8, 2013The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side RequeCVE-2013-2199 · WordPress plugins & themes · reported by Red HatMedium 4.3
The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record codex.wordpress.org wordpress.org
Jul 8, 2013The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a cCVE-2013-0235 · WordPress plugins & themes · reported by Red HatMedium 6.4
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
Fixed in
3.5.1
What to do
Update the plugin to 3.5.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jul 9, 2007WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via (1) the _wp_http_referer CVE-2007-3639 · WordPress plugins & themes · reported by MITREMedium 4
WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via (1) the _wp_http_referer parameter to wp-pass.php, related to the wp_get_referer function in wp-includes/functions.php; and possibly other vectors related to (2) wp-includes/pluggable.php and (3) the wp_nonce_ays function in wp-includes/functions.php.
Fixed in
2.2.2
What to do
Update the plugin to 2.2.2 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
May 31, 2006vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.pCVE-2006-2702 · WordPress plugins & themes · reported by MITREMedium 5
vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine $_SERVER['REMOTE_ADDR'].
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record retrogod.altervista.org secunia.com
Oct 27, 2005The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to exeCVE-2005-3330 · WordPress plugins & themes · reported by MITREHigh 7.5
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record marc.info marc.info

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.