Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

979 results · page 20 of 20

Oct 10, 2016Reflected XSS in wordpress plugin tidio-gallery v1.1CVE-2016-1000153 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin tidio-gallery v1.1
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin tidio-form v1.0CVE-2016-1000152 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin tidio-form v1.0
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin tera-charts v1.0CVE-2016-1000151 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin tera-charts v1.0
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin simplified-content v1.0.0CVE-2016-1000150 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin simplified-content v1.0.0
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin simpel-reserveren v3.5.2CVE-2016-1000149 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin simpel-reserveren v3.5.2
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin s3-video v0.983CVE-2016-1000148 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin s3-video v0.983
Affected
up to 0.983
What to do
Affects up to 0.983. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin recipes-writer v1.0.4CVE-2016-1000147 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin recipes-writer v1.0.4
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin pondol-formmail v1.1CVE-2016-1000146 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin pondol-formmail v1.1
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin pondol-carousel v1.0CVE-2016-1000145 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin pondol-carousel v1.0
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin photoxhibit v2.1.8CVE-2016-1000144 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin photoxhibit v2.1.8
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin photoxhibit v2.1.8CVE-2016-1000143 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin photoxhibit v2.1.8
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin parsi-font v4.2.5CVE-2016-1000142 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin parsi-font v4.2.5
Affected
4.2.5 to 4.2.5
What to do
Affects 4.2.5 to 4.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin page-layout-builder v1.9.3CVE-2016-1000141 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin page-layout-builder v1.9.3
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin new-year-firework v1.1.9CVE-2016-1000140 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin new-year-firework v1.1.9
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin infusionsoft v1.5.11CVE-2016-1000139 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin infusionsoft v1.5.11
Affected
up to 1.5.11
What to do
Affects up to 1.5.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin indexisto v1.0.5CVE-2016-1000138 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin indexisto v1.0.5
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin hero-maps-pro v2.1.0CVE-2016-1000137 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin hero-maps-pro v2.1.0
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin heat-trackr v1.0CVE-2016-1000136 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin heat-trackr v1.0
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin hdw-tube v1.2CVE-2016-1000135 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin hdw-tube v1.2
Affected
up to 1.2
What to do
Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin hdw-tube v1.2CVE-2016-1000134 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin hdw-tube v1.2
Affected
up to 1.2
What to do
Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1CVE-2016-1000133 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8CVE-2016-1000132 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin e-search v1.0CVE-2016-1000131 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin e-search v1.0
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin e-search v1.0CVE-2016-1000130 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin e-search v1.0
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Oct 10, 2016Reflected XSS in wordpress plugin defa-online-image-protector v3.3CVE-2016-1000129 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin defa-online-image-protector v3.3
Affected
up to 3.3
What to do
Affects up to 3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin anti-plagiarism v3.60CVE-2016-1000128 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin anti-plagiarism v3.60
Affected
up to 3.60
What to do
Affects up to 3.60. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin ajax-random-post v2.00CVE-2016-1000127 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin ajax-random-post v2.00
Affected
up to 2.00
What to do
Affects up to 2.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin admin-font-editor v1.8CVE-2016-1000126 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin admin-font-editor v1.8
Affected
up to 1.8
What to do
Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Jun 19, 2014Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject arbitrary web script CVE-2012-2572 · WordPress plugins & themes · reported by cret@cert.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Subject of an email.
Product
Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector
Fixed in
1.16
What to do
Update Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector to 1.16 or newer.
Full record and what to do →NVD record osvdb.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.