Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

1,120 results · page 21 of 23

Jan 4, 2012Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uCVE-2011-5051 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot.
Product
Multiple unrestricted file upload vulnerabilities in the WP Symposium
Fixed in
11.12.24
What to do
Update Multiple unrestricted file upload vulnerabilities in the WP Symposium to 11.12.24 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Dec 27, 2011Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers toCVE-2011-3841 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.
Product
Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium
Fixed in
11.12.08
What to do
Update Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium to 11.12.08 or newer.
Full record and what to do →NVD record secunia.com secunia.com
Nov 29, 2011Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrCVE-2011-4568 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.
Product
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer
Fixed in
1.2.12
What to do
Update Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer to 1.2.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Oct 4, 2011PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via aCVE-2011-3981 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
Product
Allwebmenus
What to do
Update Allwebmenus to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-3865 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Product
Cross-site scripting (XSS) vulnerability in the Black-LetterHead
Fixed in
1.6
What to do
Update Cross-site scripting (XSS) vulnerability in the Black-LetterHead to 1.6 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2011-3864 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Product
Cross-site scripting (XSS) vulnerability in the The Erudite
Fixed in
2.7.9
What to do
Update Cross-site scripting (XSS) vulnerability in the The Erudite to 2.7.9 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sCVE-2011-3863 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the RedLine
Fixed in
1.66
What to do
Update Cross-site scripting (XSS) vulnerability in the RedLine to 1.66 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2011-3862 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Product
Cross-site scripting (XSS) vulnerability in the Morning Coffee
Fixed in
3.6
What to do
Update Cross-site scripting (XSS) vulnerability in the Morning Coffee to 3.6 or newer.
Full record and what to do →NVD record secunia.com sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2011-3861 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Product
Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901
Fixed in
1.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 to 1.2 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via theCVE-2011-3860 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Cover WP
Fixed in
1.6.6
What to do
Update Cross-site scripting (XSS) vulnerability in the Cover WP to 1.6.6 or newer.
Full record and what to do →NVD record securityfocus.com sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cCVE-2011-3859 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Product
Cross-site scripting (XSS) vulnerability in the Trending
Fixed in
0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Trending to 0.2 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2011-3858 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Pixiv Custom
Fixed in
2.1.6
What to do
Update Cross-site scripting (XSS) vulnerability in the Pixiv Custom to 2.1.6 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via theCVE-2011-3857 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Antisnews
Fixed in
1.10
What to do
Update Cross-site scripting (XSS) vulnerability in the Antisnews to 1.10 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-3856 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Elegant Grunge
Fixed in
1.0.4
What to do
Update Cross-site scripting (XSS) vulnerability in the Elegant Grunge to 1.0.4 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CVE-2011-3855 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the F8 Lite
Fixed in
4.2.2
What to do
Update Cross-site scripting (XSS) vulnerability in the F8 Lite to 4.2.2 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s CVE-2011-3854 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the ZenLite
Fixed in
4.4
What to do
Update Cross-site scripting (XSS) vulnerability in the ZenLite to 4.4 or newer.
Full record and what to do →NVD record secunia.com sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpCVE-2011-3853 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Product
Cross-site scripting (XSS) vulnerability in the Hybrid
Fixed in
0.10
What to do
Update Cross-site scripting (XSS) vulnerability in the Hybrid to 0.10 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sCVE-2011-3852 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the EvoLve
Fixed in
1.2.6
What to do
Update Cross-site scripting (XSS) vulnerability in the EvoLve to 1.2.6 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpageCVE-2011-3851 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Product
Cross-site scripting (XSS) vulnerability in the News
Fixed in
0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the News to 0.2 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via thCVE-2011-3850 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Atahualpa
Fixed in
3.6.8
What to do
Update Cross-site scripting (XSS) vulnerability in the Atahualpa to 3.6.8 or newer.
Full record and what to do →NVD record secunia.com sitewat.ch
Sep 23, 2011WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in anCVE-2011-3818 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record code.google.com code.google.com
Sep 13, 2011SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the evCVE-2010-4839 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the event_id parameter in a register action.
Product
Event Registration
Affected
up to 5.32
What to do
Affects up to 5.32. Update Event Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com exploit-db.com
Aug 10, 2011wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibCVE-2011-3130 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection.
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 10, 2011WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vecCVE-2011-3128 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php.
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org secunia.com
Aug 10, 2011WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects.CVE-2011-3126 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects.
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 10, 2011Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."CVE-2011-3125 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 10, 2011Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."CVE-2011-3122 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 1, 2011Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers tCVE-2010-4747 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.
Product
Processing Embed
What to do
Update Processing Embed to the newest version.
Full record and what to do →NVD record secunia.com johnleitch.net
Feb 21, 2011Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrarCVE-2011-1047 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record osvdb.org osvdb.org
Jan 25, 2011Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitraCVE-2011-0641 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
StatPressCN
What to do
Update StatPressCN to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Jan 3, 2011Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML viCVE-2010-4536 · WordPress plugins & themes · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.
Fixed in
3.0.4
What to do
Update the plugin to 3.0.4 or newer.
Full record and what to do →NVD record core.trac.wordpress.org lists.fedoraproject.org
Dec 30, 2010Cross-site scripting (XSS) vulnerability in feedlist/handler_image.php in the FeedList plugin 2.61.01 for WordPress allows remote attackers to inject arbitrary CVE-2010-4637 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in feedlist/handler_image.php in the FeedList plugin 2.61.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
Product
FeedList
What to do
Update FeedList to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Dec 30, 2010Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to CVE-2010-4630 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Product
WP Survey And Quiz Tool
What to do
Update WP Survey And Quiz Tool to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Dec 22, 2010Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2010-4277 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php.
Product
Embedded Video
What to do
Update Embedded Video to the newest version.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 9, 2010Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject aCVE-2010-4518 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter.
Product
Safe Search
What to do
Update Safe Search to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 6, 2010The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php andCVE-2010-4403 · WordPress plugins & themes · reported by MITREMedium 5
The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message.
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org websecurity.com.ua
Dec 6, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to injectCVE-2010-4402 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.
Product
Register Plus
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Register Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Nov 3, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject aCVE-2010-3977 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com conviso.com.br
Jul 30, 2010SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url CVE-2010-2924 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information.
Product
myLinksDump
What to do
Update myLinksDump to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 7, 2010Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitraCVE-2010-1186 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
Product
Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery
Fixed in
1.5.2
What to do
Update Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery to 1.5.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 26, 2010SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQCVE-2009-4748 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
Product
My Category Order
Affected
up to 2.8
What to do
Affects up to 2.8. Update My Category Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org exploit-db.com
Mar 5, 2010Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files viCVE-2009-4672 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.
Product
WP-Lytebox
What to do
Update WP-Lytebox to the newest version.
Full record and what to do →NVD record secunia.com exploit-db.com
Feb 22, 2010SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitCVE-2010-0673 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.
Product
Copperleaf Photolog
What to do
Update Copperleaf Photolog to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Dec 28, 2009SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2009-4424 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Pyrmont
What to do
Update Pyrmont to the newest version.
Full record and what to do →NVD record packetstormsecurity.org exploit-db.com
Dec 18, 2009Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the searCVE-2009-3703 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.
Product
Multiple SQL injection vulnerabilities in the WP-Forum
Fixed in
2.4
What to do
Update Multiple SQL injection vulnerabilities in the WP-Forum to 2.4 or newer.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 2, 2009WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.CVE-2009-4170 · WordPress plugins & themes · reported by MITREMedium 5
WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record websecurity.com.ua securityfocus.com
Dec 2, 2009Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web sCVE-2009-4169 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in
Fixed in
1.22
What to do
Update Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in to 1.22 or newer.
Full record and what to do →NVD record roytanck.com securityfocus.com
Aug 18, 2009Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct requeCVE-2009-2854 · WordPress plugins & themes · reported by MITREMedium 6.4
Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/.
Fixed in
2.8.3
What to do
Update the plugin to 2.8.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Aug 18, 2009Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advancCVE-2009-2853 · WordPress plugins & themes · reported by MITREHigh 10
Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.
Fixed in
2.8.3
What to do
Update the plugin to 2.8.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Aug 18, 2009WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_heCVE-2009-2852 · WordPress plugins & themes · reported by MITREMedium 6.8
WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.
Affected
up to 0.9.1
What to do
Affects up to 0.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.