Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

984 results · page 20 of 20

Jul 16, 2018Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attacCVE-2018-13832 · WordPress plugins & themes · reported by MITREMedium 4.8
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text.
Product
Techotronic all-in-one-favicon (aka All In One Favicon)
Fixed in
4.6
What to do
Update Techotronic all-in-one-favicon (aka All In One Favicon) to 4.6 or newer.
Full record and what to do →NVD record hackpuntes.com exploit-db.com
Apr 10, 2018The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd paCVE-2014-3114 · WordPress plugins & themes · reported by MITRECritical 9.8
The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php.
Affected
up to 12.03.10
What to do
Affects up to 12.03.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Mar 14, 2018the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter: Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL InjCVE-2018-1000131 · WordPress plugins & themes · reported by MITRECritical 9.8
Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later.
Product
the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter
Affected
up to 9.0.2
Fixed in
9.0.3
What to do
Update the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter to 9.0.3 or newer.
Full record and what to do →NVD record github.com wordpress.org
Dec 19, 2017The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php.CVE-2017-17780 · WordPress plugins & themes · reported by MITREMedium 6.1
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 23, 2017Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.CVE-2017-14722 · WordPress plugins & themes · reported by MITREHigh 7.5
Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.CVE-2017-14719 · WordPress plugins & themes · reported by MITREHigh 7.5
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 11, 2017The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of aCVE-2017-14313 · WordPress plugins & themes · reported by MITREMedium 6.1
The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().
Product
shibboleth_login_form function in shibboleth.php in the Shibboleth
Fixed in
1.8
What to do
Update shibboleth_login_form function in shibboleth.php in the Shibboleth to 1.8 or newer.
Full record and what to do →NVD record debian.org bugs.debian.org
Aug 2, 2017The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.CVE-2017-12200 · WordPress plugins & themes · reported by MITREMedium 6.1
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.
Affected
4.2.11 to 4.2.11
What to do
Affects 4.2.11 to 4.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 17, 2017An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress.CVE-2017-6955 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack.
Product
An issue was discovered in by-email/by-email.php in the Invite Anyone
Fixed in
1.3.15
What to do
Update An issue was discovered in by-email/by-email.php in the Invite Anyone to 1.3.15 or newer.
Full record and what to do →NVD record securityfocus.com github.com
Mar 17, 2017An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress.CVE-2017-6954 · WordPress plugins & themes · reported by MITREMedium 4.3
An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.
Product
An issue was discovered in includes/component.php in the BuddyPress Docs
Fixed in
1.9.3
What to do
Update An issue was discovered in includes/component.php in the BuddyPress Docs to 1.9.3 or newer.
Full record and what to do →NVD record securityfocus.com github.com
Jun 17, 2015Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language fCVE-2015-4338 · WordPress plugins & themes · reported by MITREMedium 6.5
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2015Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via CVE-2015-4337 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual parameter in the xcloner_show page to wpadmin/plugins.php.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2015cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames wCVE-2015-4336 · WordPress plugins & themes · reported by MITREMedium 6.5
cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain seCVE-2014-8607 · WordPress plugins & themes · reported by MITRELow 2.1
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command.
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 10, 2015Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a ..CVE-2014-8606 · WordPress plugins & themes · reported by MITREMedium 4
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.
Product
XCloner
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access conCVE-2014-8605 · WordPress plugins & themes · reported by MITREMedium 5
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/.
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remoCVE-2014-8604 · WordPress plugins & themes · reported by MITREMedium 5
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obtain sensitive information via unspecified vectors.
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 10, 2015cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacCVE-2014-8603 · WordPress plugins & themes · reported by MITREMedium 6.5
cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name, or (12) $sqlfile variable.
Product
XCloner
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Apr 3, 2015The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta DescriptCVE-2015-0902 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.
Product
Semper Fi All in One SEO Pack
Fixed in
2.2.6
What to do
Update Semper Fi All in One SEO Pack to 2.2.6 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 6, 2015Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack theCVE-2015-0895 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.
Product
Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall
Fixed in
3.9.0
What to do
Update Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall to 3.9.0 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 6, 2015SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commandsCVE-2015-0894 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6
SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
SQL injection vulnerability in the All In One WP Security & Firewall
Fixed in
3.8.8
What to do
Update SQL injection vulnerability in the All In One WP Security & Firewall to 3.8.8 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Oct 2, 2014Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arCVE-2014-6242 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Product
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall
Fixed in
3.8.3
What to do
Update Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall to 3.8.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Apr 25, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administCVE-2014-2579 · WordPress plugins & themes · reported by MITREHigh 7.6
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands.
Product
generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner
Affected
up to 3.5
What to do
Affects up to 3.5. Update generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Apr 3, 2014Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of adminisCVE-2014-2340 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.
Product
Cross-site request forgery (CSRF) vulnerability in the XCloner
Fixed in
3.1.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the XCloner to 3.1.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Dec 29, 2013the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier: Cross-site request forgery (CSRF)CVE-2013-7233 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.
Product
the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org osvdb.org
Jul 29, 2013Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" componenCVE-2013-4944 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" component is enabled, allows remote attackers to inject arbitrary web script or HTML via the friendship_request_message parameter to wp-admin/admin-ajax.php. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request
Fixed in
1.0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request to 1.0.2 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 25, 2013Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authenticatiCVE-2013-2696 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster
Fixed in
8.2.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster to 8.2.4 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 14, 2012Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitraryCVE-2012-1835 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL databasCVE-2012-0937 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 30, 2012Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attacCVE-2012-0782 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate,CVE-2011-4899 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameteCVE-2011-4898 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jul 9, 2009template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin,: PHP remote file inclusionCVE-2009-2396 · WordPress plugins & themes · reported by MITREHigh 9.3
PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.
Product
template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin,
What to do
Update template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, to the newest version.
Full record and what to do →NVD record secunia.com exploit-db.com
Oct 1, 2007the internal browser in i-Systems Feedreader 3.10: Cross-zone scriptingCVE-2007-5161 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-zone scripting vulnerability in the internal browser in i-Systems Feedreader 3.10 allows remote attackers to inject arbitrary web script or HTML via an item in a feed, as demonstrated by a WordPress blog update. NOTE: this was originally reported as XSS.
Product
the internal browser in i-Systems Feedreader 3.10
What to do
Update the internal browser in i-Systems Feedreader 3.10 to the newest version.
Full record and what to do →NVD record marc.info osvdb.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.