Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,023 results · page 21 of 21

Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script CVE-2014-7138 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the Google Calendar Events
Fixed in
2.0.4
What to do
Update Cross-site scripting (XSS) vulnerability in the Google Calendar Events to 2.0.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 12, 2014game_play.php in the FB Gorilla plugin for: SQL injectionCVE-2014-5200 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
game_play.php in the FB Gorilla plugin for
What to do
Update game_play.php in the FB Gorilla plugin for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allows remote attackers tCVE-2014-4563 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Product
URL Cloak & Encrypt (url-cloak-encrypt)
Affected
up to 2.0
What to do
Affects up to 2.0. Update URL Cloak & Encrypt (url-cloak-encrypt) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in book_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inject arbitrary web scCVE-2014-4546 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in book_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the response parameter.
Product
Rezgo
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Rezgo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in posts/videowhisper/r_logout.php in the Video Posts Webcam Recorder plugin 1.55.4 and earlier for WordPress allows reCVE-2014-4568 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in posts/videowhisper/r_logout.php in the Video Posts Webcam Recorder plugin 1.55.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Product
Video Posts Webcam Recorder
Affected
up to 1.55.4
What to do
Affects up to 1.55.4. Update Video Posts Webcam Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Jul 2, 2014Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) plugin 3.1.0 and earlier for WorCVE-2014-4557 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) plugin 3.1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
Product
Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop)
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for WordPress allow remoCVE-2014-4547 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) tags or (2) search_for parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking
Fixed in
1.8.2
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking to 1.8.2 or newer.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Jul 2, 2014Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for WordPress allows remote CVE-2014-4540 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Product
Oleggo LiveStream
Affected
up to 0.2.6
What to do
Affects up to 0.2.6. Update Oleggo LiveStream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 CVE-2014-4528 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) promo_type, (2) fb_edit_action, or (3) promo_id parameter.
Product
Bugs Go Viral : Facebook Promotion Generator (fbpromotions)
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Bugs Go Viral : Facebook Promotion Generator (fbpromotions) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
May 29, 2014Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-4915 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 5
Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to libs/pdf.php.
Product
Directory traversal vulnerability in the Google Doc Embedder
Fixed in
2.5.4
What to do
Update Directory traversal vulnerability in the Google Doc Embedder to 2.5.4 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Mar 14, 2014the Responsive Logo Slideshow plugin for: Cross-site scripting (XSS)CVE-2013-1759 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the "URL and Image" field.
Product
the Responsive Logo Slideshow plugin for
What to do
Update the Responsive Logo Slideshow plugin for to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web scCVE-2012-6630 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) bulk parameter to media-library-categories/add.php or (2) q parameter to media-library-categories/view.php.
Product
Media Library Categories
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update Media Library Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2012-6624 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloud_is_gold_player_preview action to wp-admin/admin-ajax.php.
Product
SoundCloud Is Gold
Affected
2.1 to 2.1
What to do
Affects 2.1 to 2.1. Update SoundCloud Is Gold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jul 16, 2013Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to injCVE-2013-4117 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
Product
Category Grid View Gallery
What to do
Update Category Grid View Gallery to the newest version.
Full record and what to do →NVD record exploit.iedb.ir openwall.com
Dec 27, 2012WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discoverCVE-2012-5868 · WordPress plugins & themes · reported by MITRELow 2.6
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record whiteoaksecurity.com whiteoaksecurity.com
Mar 26, 2010SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQCVE-2009-4748 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
Product
My Category Order
Affected
up to 2.8
What to do
Affects up to 2.8. Update My Category Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org exploit-db.com
Oct 23, 2009wp-trackback.php in WordPress before 2.8.5: Algorithmic complexityCVE-2009-3622 · WordPress plugins & themes · reported by Red HatMedium 4.3
Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8" substrings, related to the mb_convert_encoding function in PHP.
Product
wp-trackback.php in WordPress before 2.8.5
Fixed in
2.8.5
What to do
Update wp-trackback.php in WordPress before 2.8.5 to 2.8.5 or newer.
Full record and what to do →NVD record codes.zerial.org marc.info
Aug 18, 2009Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advancCVE-2009-2853 · WordPress plugins & themes · reported by MITREHigh 10
Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.
Fixed in
2.8.3
What to do
Update the plugin to 2.8.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Jul 10, 2009The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user accountCVE-2009-2336 · WordPress plugins & themes · reported by MITREMedium 5
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Fixed in
2.8.1
What to do
Update the plugin to 2.8.1 or newer.
Full record and what to do →NVD record corelabs.coresecurity.com securitytracker.com
Oct 28, 2008the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5,: Directory traversalCVE-2008-4769 · WordPress plugins & themes · reported by MITREHigh 9.3
Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from third party information.
Product
the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5,
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com trac.wordpress.org
Feb 20, 2008the log feature in the John Godley Search Unleashed 0.2.10 plugin for: Cross-site scripting (XSS)CVE-2008-0837 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the log feature in the John Godley Search Unleashed 0.2.10 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, which is not properly handled when the administrator views the log file.
Product
the log feature in the John Godley Search Unleashed 0.2.10 plugin for
What to do
Update the log feature in the John Godley Search Unleashed 0.2.10 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Jul 5, 2005wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, wCVE-2005-2109 · WordPress plugins & themes · reported by MITREMedium 5
wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.
Affected
up to 1.5.1.2
What to do
Affects up to 1.5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record marc.info secunia.com
Jun 1, 2005template-functions-category.php in WordPress 1.5.1: SQL injectionCVE-2005-1810 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $cat_ID variable, as demonstrated using the cat parameter to index.php.
Product
template-functions-category.php in WordPress 1.5.1
What to do
Update template-functions-category.php in WordPress 1.5.1 to the newest version.
Full record and what to do →NVD record bugs.gentoo.org marc.info

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.