Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

1,120 results · page 20 of 23

Oct 8, 2012PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP CVE-2011-4342 · WordPress plugins & themes · reported by Red HatHigh 7.5
PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.
Product
PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup
Fixed in
1.7.2
What to do
Update PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup to 1.7.2 or newer.
Full record and what to do →NVD record packetstormsecurity.org seclists.org
Oct 8, 2012Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute CVE-2012-5318 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the directory specified by the folder parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1125.
Product
Kish Guest Posting
What to do
Update Kish Guest Posting to the newest version.
Full record and what to do →NVD record secunia.com openwall.com
Oct 8, 2012SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vCVE-2012-5310 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
SQL injection vulnerability in the WP e-Commerce
Fixed in
3.8.7.6
What to do
Update SQL injection vulnerability in the WP e-Commerce to 3.8.7.6 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Oct 8, 2012Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to eCVE-2012-1125 · WordPress plugins & themes · reported by Red HatMedium 6.8
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
Product
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting
Fixed in
1.2
What to do
Update Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting to 1.2 or newer.
Full record and what to do →NVD record archives.neohapsis.com plugins.svn.wordpress.org
Oct 1, 2012Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via thCVE-2012-4242 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page.
Product
MF Gig Calendar
What to do
Update MF Gig Calendar to the newest version.
Full record and what to do →NVD record reactionpenetrationtesting.co.uk securityfocus.com
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers CVE-2011-5194 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter, a different vulnerability than CVE-2011-5193.
Product
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search
Fixed in
1.4.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search to 1.4.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Sep 23, 2012Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary webCVE-2011-5192 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5191.
Product
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite
Fixed in
1.5.6
What to do
Update Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite to 1.5.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Sep 23, 2012Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.4 for WordPress allows remote attackers to inject arbitrary webCVE-2011-5191 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5192.
Product
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite
Fixed in
1.5.4
What to do
Update Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite to 1.5.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 20, 2012Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitCVE-2011-5182 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input, and because that input is never sent to the browser, an attacker has no way of executing script or code on a user's behalf.
Product
Lanoba Social
What to do
Update Lanoba Social to the newest version.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Sep 20, 2012Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web scriCVE-2011-5180 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information. NOTE: this has been disputed by a third party.
Product
ZooEffect
What to do
Update ZooEffect to the newest version.
Full record and what to do →NVD record osvdb.org securityfocus.com
Sep 6, 2012Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads."CVE-2012-4874 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads."
Product
Unspecified vulnerability in the Another WordPress Classifieds
Fixed in
2.0
What to do
Update Unspecified vulnerability in the Another WordPress Classifieds to 2.0 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Aug 29, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script oCVE-2011-5128 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, or (3) inc-options/im_export_options.php, or the (4) post or (5) post_ID parameters to adminimize.php, different vectors than CVE-2011-4926.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize
Fixed in
1.7.22
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize to 1.7.22 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 29, 2012Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to injecCVE-2011-4926 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Product
Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize
Fixed in
1.7.22
What to do
Update Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize to 1.7.22 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 23, 2012Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject aCVE-2011-5106 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type
Fixed in
0.1.7
What to do
Update Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type to 0.1.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 15, 2012Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module before 3.2 for WordPress allow remote attackers to inject arbCVE-2012-3434 · WordPress plugins & themes · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module before 3.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) datemin, or (3) datemax parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module
Fixed in
3.2
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module to 3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 14, 2012The ShareYourCart plugin 1.7.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors related to the SDK.CVE-2012-4332 · WordPress plugins & themes · reported by MITREMedium 5
The ShareYourCart plugin 1.7.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors related to the SDK.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 14, 2012Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.CVE-2012-4327 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.
Product
Unspecified vulnerability in the Image News slider
Fixed in
3.3
What to do
Update Unspecified vulnerability in the Image News slider to 3.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 14, 2012Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitraryCVE-2012-1835 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Aug 13, 2012Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTCVE-2012-4283 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter.
Product
Cross-site scripting (XSS) vulnerability in the Login With Ajax
Fixed in
3.0.4.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Login With Ajax to 3.0.4.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 13, 2012Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to injectCVE-2012-4273 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.
Product
Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons
Fixed in
0.34
What to do
Update Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons to 0.34 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Aug 13, 2012Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrCVE-2012-4272 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "processing of the buttons of Xing and Pinterest".
Product
Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons
Fixed in
0.34
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons to 0.34 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 13, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to iCVE-2012-4264 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "server variables," a different vulnerability than CVE-2012-4263.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security)
Fixed in
3.2.5
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) to 3.2.5 or newer.
Full record and what to do →NVD record bit51.com plugins.trac.wordpress.org
Aug 13, 2012Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2012-2371 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.
Product
WP-FaceThumb
What to do
Update WP-FaceThumb to the newest version.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jul 18, 2012Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.CVE-2012-4033 · WordPress plugins & themes · reported by MITREHigh 10
Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.
Product
Multiple unspecified vulnerabilities in the Zingiri Web Shop
Fixed in
2.4.0
What to do
Update Multiple unspecified vulnerabilities in the Zingiri Web Shop to 2.4.0 or newer.
Full record and what to do →NVD record forums.zingiri.com secunia.com
Jun 27, 2012Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code CVE-2012-3814 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in font-uploader/fonts.
Product
Font Uploader
What to do
Update Font Uploader to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 19, 2012Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-3588 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.
Product
Plugin Newsletter
What to do
Update Plugin Newsletter to the newest version.
Full record and what to do →NVD record secunia.com exploit-db.com
Jun 16, 2012Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbiCVE-2012-3578 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in html/images.
Product
FCChat Widget
Affected
up to 2.2.13.1
What to do
Affects up to 2.2.13.1. Update FCChat Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jun 16, 2012Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbiCVE-2012-3577 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/user_uploads.
Product
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation
Fixed in
1.4
What to do
Update Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation to 1.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jun 15, 2012Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary codeCVE-2012-3576 · WordPress plugins & themes · reported by MITREHigh 10
Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/wpstorecart.
Product
Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart
Fixed in
2.5.30
What to do
Update Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart to 2.5.30 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jun 15, 2012Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploadinCVE-2012-3575 · WordPress plugins & themes · reported by MITREHigh 10
Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/rbxslider.
Product
RBX Gallery
What to do
Update RBX Gallery to the newest version.
Full record and what to do →NVD record secunia.com exploit-db.com
Jun 15, 2012Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script CVE-2012-2633 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
Product
Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp
Fixed in
1.8.3.1
What to do
Update Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp to 1.8.3.1 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
May 21, 2012Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2012-2917 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.
Product
Share and Follow
What to do
Update Share and Follow to the newest version.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
May 21, 2012Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-2916 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the active_option parameter to wp-admin/tools.php.
Product
Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE
Fixed in
2.1
What to do
Update Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE to 2.1 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
May 21, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via CVE-2012-2913 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) leaflet_layer.php or (2) leaflet_marker.php, as reachable through wp-admin/admin.php.
Product
Leaflet
What to do
Update Leaflet to the newest version.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
May 21, 2012Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML CVE-2012-2912 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php.
Product
LeagueManager
What to do
Update LeagueManager to the newest version.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
Apr 21, 2012wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attaCVE-2012-2404 · WordPress plugins & themes · reported by MITREMedium 4.3
wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org osvdb.org
Apr 21, 2012wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conductCVE-2012-2403 · WordPress plugins & themes · reported by MITREMedium 4.3
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Apr 21, 2012Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.CVE-2012-2400 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org osvdb.org
Mar 19, 2012The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknoCVE-2012-1786 · WordPress plugins & themes · reported by MITREMedium 5
The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
Product
Media Upload form in the Video Embed & Thumbnail Generator
Fixed in
2.0
What to do
Update Media Upload form in the Video Embed & Thumbnail Generator to 2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 19, 2012kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecifiedCVE-2012-1785 · WordPress plugins & themes · reported by MITREHigh 7.5
kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
Product
kg_callffmpeg.php in the Video Embed & Thumbnail Generator
Fixed in
2.0
What to do
Update kg_callffmpeg.php in the Video Embed & Thumbnail Generator to 2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Mar 19, 2012Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-5082 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
Product
s2Member Pro
Fixed in
111220
What to do
Update s2Member Pro to 111220 or newer.
Full record and what to do →NVD record secunia.com primothemes.com
Feb 24, 2012PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary CVE-2012-1205 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
Product
PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload
Fixed in
0.20
What to do
Update PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload to 0.20 or newer.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers CVE-2012-1068 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
Product
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments
Fixed in
2.0.7
What to do
Update Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments to 2.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Feb 14, 2012SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter iCVE-2012-1067 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
WP-RecentComments
What to do
Update WP-RecentComments to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Feb 7, 2012actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP codCVE-2012-1011 · WordPress plugins & themes · reported by MITREHigh 7.5
actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Product
AllWebMenus
What to do
Update AllWebMenus to the newest version.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Feb 7, 2012Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP codeCVE-2012-1010 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Product
Unrestricted file upload vulnerability in actions.php in the AllWebMenus
Fixed in
1.1.8
What to do
Update Unrestricted file upload vulnerability in actions.php in the AllWebMenus to 1.1.8 or newer.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Jan 30, 2012Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attacCVE-2012-0782 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 20, 2012Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-0898 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.
Product
myEASYbackup
What to do
Update myEASYbackup to the newest version.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 20, 2012Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files viaCVE-2012-0896 · WordPress plugins & themes · reported by MITREMedium 5
Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
Product
Absolute path traversal vulnerability in download.php in the Count Per Day module
Fixed in
3.1.1
What to do
Update Absolute path traversal vulnerability in download.php in the Count Per Day module to 3.1.1 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Jan 20, 2012Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-0895 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter.
Product
Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module
Fixed in
3.1.1
What to do
Update Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module to 3.1.1 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.