Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

10,215 results · page 200 of 205

Apr 1, 2020An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.CVE-2020-7947 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.
Product
An issue was discovered in the Login by Auth0
Fixed in
4.0.0
What to do
Update An issue was discovered in the Login by Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com auth0.com
Apr 1, 2020The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.CVE-2020-6753 · WordPress plugins & themes · reported by MITREMedium 6.1
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.
Product
Login by Auth0
Fixed in
4.0.0
What to do
Update Login by Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com github.com
Apr 1, 2020A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.CVE-2020-5392 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.
Product
A stored cross-site scripting (XSS) vulnerability exists in the Auth0
Fixed in
4.0.0
What to do
Update A stored cross-site scripting (XSS) vulnerability exists in the Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com github.com
Apr 1, 2020Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.CVE-2020-5391 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.
Product
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0
Fixed in
4.0.0
What to do
Update Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com github.com
Mar 10, 2020controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via tCVE-2018-14502 · WordPress plugins & themes · reported by MITRECritical 9.8
controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.
Product
controllers/quizzes.php in the Kiboko Chained Quiz
Fixed in
1.0.9
What to do
Update controllers/quizzes.php in the Kiboko Chained Quiz to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submittCVE-2020-9458 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and chaCVE-2020-9457 · WordPress plugins & themes · reported by MITREHigh 8.8
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their CVE-2020-9456 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of theCVE-2020-9455 · WordPress plugins & themes · reported by MITREMedium 4.3
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 28, 2020Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticaCVE-2020-9459 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.
Product
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Feb 26, 2020The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufCVE-2019-19134 · WordPress plugins & themes · reported by MITREMedium 6.1
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record heroplugins.com heroplugins.com
Feb 8, 2020Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitraryCVE-2015-1394 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery
Fixed in
1.2.11
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery to 1.2.11 or newer.
Full record and what to do →NVD record securityfocus.com plugins.trac.wordpress.org
Feb 6, 2020The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.CVE-2020-8772 · WordPress plugins & themes · reported by MITRECritical 9.8
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.
Product
InfiniteWP Client
Fixed in
1.9.4.5
What to do
Update InfiniteWP Client to 1.9.4.5 or newer.
Full record and what to do →NVD record wpvulndb.com webarxsecurity.com
Feb 6, 2020The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass.CVE-2020-8771 · WordPress plugins & themes · reported by MITRECritical 9.8
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
Product
Time Capsule
Fixed in
1.21.16
What to do
Update Time Capsule to 1.21.16 or newer.
Full record and what to do →NVD record wpvulndb.com webarxsecurity.com
Feb 5, 2020The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.CVE-2019-20173 · WordPress plugins & themes · reported by MITREMedium 6.1
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
Product
Auth0 wp-auth0 plugin 3.11.x
Fixed in
3.11.3
What to do
Update Auth0 wp-auth0 plugin 3.11.x to 3.11.3 or newer.
Full record and what to do →NVD record auth0.com github.com
Jan 28, 2020Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication ofCVE-2015-5483 · WordPress plugins & themes · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.
Product
Private Only
Affected
3.5.1 to 3.5.1
What to do
Affects 3.5.1 to 3.5.1. Update Private Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 27, 2020WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerabilityCVE-2013-4462 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 16, 2020The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WorCVE-2020-7048 · WordPress plugins & themes · reported by MITRECritical 9.1
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored in that table), as demonstrated by a wp-admin/admin-post.php?db-reset-tables[]=comments URI.
Affected
up to 3.1
What to do
Affects up to 3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 16, 2020The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-aCVE-2020-7047 · WordPress plugins & themes · reported by MITREHigh 8.8
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table.
Affected
up to 3.1
What to do
Affects up to 3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 15, 2020Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTMCVE-2015-5484 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post.
Product
Cross-site scripting (XSS) vulnerability in the Plotly
Fixed in
1.0.3
What to do
Update Cross-site scripting (XSS) vulnerability in the Plotly to 1.0.3 or newer.
Full record and what to do →NVD record seclists.org security.dxw.com
Jan 9, 2020A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenaCVE-2020-6168 · WordPress plugins & themes · reported by MITREHigh 7.6
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings (impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting).
Affected
up to 2.10
What to do
Affects up to 2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 9, 2020A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change CVE-2020-6166 · WordPress plugins & themes · reported by MITREMedium 5.4
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes.
Affected
up to 2.15
What to do
Affects up to 2.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 8, 2020A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user infoCVE-2019-20360 · WordPress plugins & themes · reported by MITREHigh 7.5
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.
Fixed in
2.5.5
What to do
Update the plugin to 2.5.5 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Jan 6, 2020Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web scrCVE-2015-4039 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2.
Product
WP Membership
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update WP Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jan 2, 2020The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an emailCVE-2019-20203 · WordPress plugins & themes · reported by MITREMedium 5.3
The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.
Product
Postie
Affected
up to 1.9.40
What to do
Affects up to 1.9.40. Update Postie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com postieplugin.com
Dec 27, 2019In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a pCVE-2019-20043 · WordPress plugins & themes · reported by MITREMedium 4.3
In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record core.trac.wordpress.org github.com
Dec 26, 2019In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed withiCVE-2019-16781 · WordPress plugins & themes · reported by GitHubMedium 5.8
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
Fixed in
5.3.1
What to do
Update the plugin to 5.3.1 or newer.
Full record and what to do →NVD record github.com hackerone.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.CVE-2019-19985 · WordPress plugins & themes · reported by MITREMedium 5.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation.CVE-2019-19982 · WordPress plugins & themes · reported by MITREMedium 5.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name= request.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) CVE-2019-19980 · WordPress plugins & themes · reported by MITREMedium 4.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wp_ajax function to send_test_email.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.CVE-2019-17234 · WordPress plugins & themes · reported by MITREHigh 7.5
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
Product
includes/class-coming-soon-creator.php in the igniteup
Affected
up to 3.4
What to do
Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Nov 6, 2019The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary userCVE-2014-9013 · WordPress plugins & themes · reported by MITREHigh 8.8
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.
Product
WP Marketplace
Affected
2.4.0 to 2.4.0
What to do
Affects 2.4.0 to 2.4.0. Update WP Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 31, 2019plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.CVE-2019-16251 · WordPress plugins & themes · reported by MITREMedium 4.3
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
Product
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Oct 17, 2019In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.CVE-2019-17671 · WordPress plugins & themes · reported by MITREMedium 5.3
In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org core.trac.wordpress.org
Oct 7, 2019Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.CVE-2019-17232 · WordPress plugins & themes · reported by MITREHigh 7.5
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
Product
Functions/EWD_UFAQ_Import.php in the ultimate-faqs
Affected
up to 1.8.24
What to do
Affects up to 1.8.24. Update Functions/EWD_UFAQ_Import.php in the ultimate-faqs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Oct 7, 2019includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated storCVE-2019-17239 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
Product
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 6, 2019The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.CVE-2019-17213 · WordPress plugins & themes · reported by MITREMedium 6.1
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
Affected
1.3.0 to 1.3.0
What to do
Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com acunetix.com
Oct 3, 2019A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or otheCVE-2019-16931 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
Product
Visualizer
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Visualizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record nathandavison.com wordpress.org
Sep 27, 2019In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full paCVE-2019-16902 · WordPress plugins & themes · reported by MITREHigh 7.5
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.
Product
ARforms
Affected
3.7.1 to 3.7.1
What to do
Affects 3.7.1 to 3.7.1. Update ARforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record almorabea.net arformsplugin.com
Sep 25, 2019The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.CVE-2015-9435 · WordPress plugins & themes · reported by MITRECritical 9.8
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
Product
oauth2-provider
Fixed in
3.1.5
What to do
Update oauth2-provider to 3.1.5 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Sep 17, 2019The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.CVE-2016-10976 · WordPress plugins & themes · reported by MITREMedium 6.1
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
Product
safe-editor
Fixed in
1.2
What to do
Update safe-editor to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 16, 2019The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.CVE-2016-10959 · WordPress plugins & themes · reported by MITREMedium 6.5
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
Product
estatik
Fixed in
2.3.1
What to do
Update estatik to 2.3.1 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Sep 16, 2019The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.CVE-2016-10958 · WordPress plugins & themes · reported by MITREHigh 7.5
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.
Product
estatik
Fixed in
2.3.0
What to do
Update estatik to 2.3.0 or newer.
Full record and what to do →NVD record estatik.net wordpress.org
Sep 15, 2019In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possiCVE-2019-16332 · WordPress plugins & themes · reported by MITREMedium 6.1
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
Product
api-bearer-auth
Fixed in
20190907
What to do
Update api-bearer-auth to 20190907 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 13, 2019The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.CVE-2019-16289 · WordPress plugins & themes · reported by MITREMedium 5.4
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
Product
insert-php (aka Woody ad snippets)
Fixed in
2.2.8
What to do
Update insert-php (aka Woody ad snippets) to 2.2.8 or newer.
Full record and what to do →NVD record generaleg0x01.com wordpress.org
Sep 11, 2019includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style SheetCVE-2019-16250 · WordPress plugins & themes · reported by MITREHigh 7.5
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.
Product
includes/wizard/wizard.php in the Ocean Extra
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update includes/wizard/wizard.php in the Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Sep 11, 2019WordPress before 5.2.3 allows XSS in post previews by authenticated users.CVE-2019-16223 · WordPress plugins & themes · reported by MITREMedium 5.4
WordPress before 5.2.3 allows XSS in post previews by authenticated users.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com lists.debian.org
Sep 9, 2019search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.CVE-2019-15895 · WordPress plugins & themes · reported by MITREHigh 7.5
search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.
Product
search-exclude.php in the "Search Exclude
Fixed in
1.2.4
What to do
Update search-exclude.php in the "Search Exclude to 1.2.4 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 9, 2019The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.CVE-2018-21011 · WordPress plugins & themes · reported by MITREHigh 7.5
The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.
Product
charitable
Fixed in
1.5.14
What to do
Update charitable to 1.5.14 or newer.
Full record and what to do →NVD record wordpress.org wpcharitable.com
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Product
admin/includes/class.import.snippet.php in the "Woody ad snippets
Fixed in
2.2.5
What to do
Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.