Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

1,156 results · page 21 of 24

Mar 11, 2017In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.CVE-2017-6818 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 11, 2017In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.CVE-2017-6816 · WordPress plugins & themes · reported by MITREMedium 4.9
In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6578 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: subscriber_email.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6577 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6576 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/campaign-delete.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6575 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: member_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6574 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6573 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit-list.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6572 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/add_member.php with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6571 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6570 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign-list.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Jan 29, 2017wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2: Cross-site scripting (XSS)CVE-2017-5612 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.
Product
wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2
Fixed in
4.7.2
What to do
Update wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 to 4.7.2 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 29, 2017wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface,CVE-2017-5610 · WordPress plugins & themes · reported by security@debian.orgMedium 5.3
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.
Fixed in
4.7.2
What to do
Update the plugin to 4.7.2 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 23, 2017Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL comCVE-2016-0769 · WordPress plugins & themes · reported by Red HatHigh 8.8
Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
Product
eShop
Affected
6.3.14 to 6.3.14
What to do
Affects 6.3.14 to 6.3.14. Update eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 18, 2017the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6: Cross-site request forgery (CSRF)CVE-2016-6897 · WordPress plugins & themes · reported by MITREMedium 6.5
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
Product
the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6
Fixed in
4.6
What to do
Update the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 to 4.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 18, 2017the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3: Directory traversalCVE-2016-6896 · WordPress plugins & themes · reported by MITREHigh 7.1
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.
Product
the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3
What to do
Update the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 to the newest version.
Full record and what to do →NVD record openwall.com securitytracker.com
Jan 18, 2017The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_pluginsCVE-2016-10148 · WordPress plugins & themes · reported by MITREMedium 4.3
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.
Fixed in
4.6
What to do
Update the plugin to 4.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 14, 2017Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script CVE-2017-5488 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 4, 2017Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPCVE-2016-7169 · WordPress plugins & themes · reported by MITREMedium 6.3
Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jan 4, 2017Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackeCVE-2016-7168 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 3, 2017Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary webCVE-2016-10112 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted tax-rate table values in CSV format.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.6.9
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.6.9 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Oct 10, 2016Reflected XSS in wordpress plugin admin-font-editor v1.8CVE-2016-1000126 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin admin-font-editor v1.8
Affected
up to 1.8
What to do
Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Aug 7, 2016the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5: Cross-site request forgery (CSRF)CVE-2016-6635 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.
Product
the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5
Fixed in
4.5
What to do
Update the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 to 4.5 or newer.
Full record and what to do →NVD record codex.wordpress.org debian.org
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/inCVE-2016-5835 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3: Cross-site scripting (XSS)CVE-2016-5833 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
Product
the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3
Fixed in
4.5.3
What to do
Update the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 to 4.5.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Dec 29, 2015Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrarCVE-2015-7791 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.3
Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) search[column] or (2) switch parameter.
Product
Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart
Fixed in
1.5.3
What to do
Update Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart to 1.5.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Nov 9, 2015the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5733 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title.
Product
the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Nov 9, 2015wp-admin/post.php in WordPress before 4.2.4: Cross-site request forgery (CSRF)CVE-2015-5731 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action.
Product
wp-admin/post.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update wp-admin/post.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 2, 2015Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL comCVE-2015-5308 · WordPress plugins & themes · reported by Red HatHigh 7.5
Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.
Product
wp-championship
Affected
5.8 to 5.8
What to do
Affects 5.8 to 5.8. Update wp-championship to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org wpvulndb.com
Oct 16, 2015Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitrary files via a full CVE-2015-7683 · WordPress plugins & themes · reported by MITREMedium 4
Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitrary files via a full pathname in the url parameter to AjaxProxy.php.
Product
Absolute path traversal vulnerability in Font.php in the Font
Fixed in
7.5.1
What to do
Update Absolute path traversal vulnerability in Font.php in the Font to 7.5.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 16, 2015Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to exCVE-2015-7682 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register
Fixed in
2.0.19
What to do
Update Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register to 2.0.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 29, 2015Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.CVE-2015-7320 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Fixed in
1.1.8
What to do
Update the plugin to 1.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 29, 2015SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows rCVE-2015-7319 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
Product
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar
Fixed in
1.1.8
What to do
Update SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar to 1.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 31, 2015Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators toCVE-2015-6535 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
Product
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed
Fixed in
3.3.3
What to do
Update Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 19, 2015Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of adminiCVE-2015-6523 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.
Product
Cross-site request forgery (CSRF) vulnerability in the Portfolio
Fixed in
1.05
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Portfolio to 1.05 or newer.
Full record and what to do →NVD record seclists.org plugins.trac.wordpress.org
Aug 18, 2015Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary loCVE-2015-5482 · WordPress plugins & themes · reported by MITREMedium 4
Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Product
Directory traversal vulnerability in the GD bbPress Attachments
Fixed in
2.3
What to do
Update Directory traversal vulnerability in the GD bbPress Attachments to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com security.dxw.com
Jun 10, 2015Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a ..CVE-2014-8606 · WordPress plugins & themes · reported by MITREMedium 4
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.
Product
XCloner
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 10, 2015cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacCVE-2014-8603 · WordPress plugins & themes · reported by MITREMedium 6.5
cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name, or (12) $sqlfile variable.
Product
XCloner
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 3, 2015The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings actionCVE-2015-4038 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings action to wp-admin/admin-ajax.php.
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 28, 2015Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to CVE-2015-4133 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
Product
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery
Fixed in
3.1.4
What to do
Update Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery to 3.1.4 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
May 28, 2015Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2015-4127 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.
Product
Cross-site scripting (XSS) vulnerability in the church_admin
Fixed in
0.810
What to do
Update Cross-site scripting (XSS) vulnerability in the church_admin to 0.810 or newer.
Full record and what to do →NVD record packetstormsecurity.com osvdb.org
May 27, 2015Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitCVE-2015-4066 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress
Fixed in
2.3.9
What to do
Update Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress to 2.3.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Apr 21, 2015Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote attackers to execute arbCVE-2015-2825 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the path parameter.
Product
Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager
Fixed in
2.5.96
What to do
Update Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager to 2.5.96 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Apr 14, 2015Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitraCVE-2014-9311 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the location[id] parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic
Fixed in
7.6.1.0
What to do
Update Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic to 7.6.1.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com security.szurek.pl
Mar 17, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x beCVE-2015-2293 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.
Fixed in
1.5.7
What to do
Update the plugin to 1.5.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 17, 2015Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.CVE-2015-2292 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Fixed in
1.5.7
What to do
Update the plugin to 1.5.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 5, 2015Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.CVE-2014-9688 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
Product
Unspecified vulnerability in the Ninja Forms
Fixed in
2.8.10
What to do
Update Unspecified vulnerability in the Ninja Forms to 2.8.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 3, 2015The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access viCVE-2014-9283 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
Product
BestWebSoft Captcha
Fixed in
4.0.7
What to do
Update BestWebSoft Captcha to 4.0.7 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Feb 11, 2015admin/upload-file.php in the Holding Pattern: Unrestricted file uploadCVE-2015-1172 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
Product
admin/upload-file.php in the Holding Pattern
Affected
up to 0.6
What to do
Affects up to 0.6. Update admin/upload-file.php in the Holding Pattern to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jan 15, 2015inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart: Unrestricted file uploadCVE-2014-9308 · WordPress plugins & themes · reported by MITREMedium 6.5
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in products/banners/.
Product
inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart
Fixed in
3.0.9
What to do
Update inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart to 3.0.9 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.