Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
60 results · page 2 of 2
Mar 23, 2022Photoswipe Masonry Gallery: Cross-Site ScriptingCVE-2022-0750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
- Product
- Photoswipe Masonry Gallery
- Affected
- up to 1.2.14
- What to do
- Affects up to 1.2.14. Update Photoswipe Masonry Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 30, 2019An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.CVE-2019-20141 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
- Product
- Laborator Neon
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update Laborator Neon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordknassar702.github.ioknassar7o2.blogspot.com
Oct 7, 2019The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parametCVE-2015-9455 · WordPress plugins & themes · reported by MITREHigh 8.1
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
- Product
- buddypress-activity-plus
- Fixed in
- 1.6.2
- What to do
- Update buddypress-activity-plus to 1.6.2 or newer.
Full record and what to do →NVD recordsecurity.dxw.comwordpress.org
Sep 26, 2019The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.CVE-2015-9444 · WordPress plugins & themes · reported by MITREMedium 6.1
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
- Affected
- 1.3.0 to 1.3.0
- What to do
- Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Aug 15, 2019The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked CVE-2019-14795 · WordPress plugins & themes · reported by MITREMedium 4.8
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jun 15, 2019The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.CVE-2013-7472 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
- Product
- Count per Day
- Fixed in
- 3.2.6
- What to do
- Update Count per Day to 3.2.6 or newer.
Full record and what to do →NVD recordlists.openwall.networdpress.org
Feb 25, 2019WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.CVE-2019-9168 · WordPress plugins & themes · reported by MITREMedium 6.1
WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.
- Fixed in
- 3.5.5
- What to do
- Update the plugin to 3.5.5 or newer.
Full record and what to do →NVD recordwoocommerce.wordpress.comwoocommerce.wordpress.com
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating fCVE-2015-4617 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.
- Affected
- 1.09 to 1.09
- What to do
- Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXMLCVE-2015-4615 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables
- Affected
- 1.09 to 1.09
- What to do
- Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapid.dhs.orgwordpress.org
Jan 1, 2015Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2011-5307 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
- Product
- PhotoSmash
- Affected
- 1.01 to 1.01
- What to do
- Affects 1.01 to 1.01. Update PhotoSmash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.