Updated 36 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,156 results · page 22 of 24

Jan 13, 2015Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject aCVE-2014-100026 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack
Fixed in
1.4.8
What to do
Update Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack to 1.4.8 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Jan 12, 2015SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands via the s parameter CVE-2014-2839 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php.
Product
GD Star Rating
Affected
19.22 to 19.22
What to do
Affects 19.22 to 19.22. Update GD Star Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org advisories.dxw.com
Dec 1, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Server-side request forgery (SSRF)CVE-2014-8749 · WordPress plugins & themes · reported by MITREMedium 5
Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
Affected
up to .51
What to do
Affects up to .51. Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wordpress.org
Nov 26, 2014Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of adminiCVE-2014-9099 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydowork_adsense page in wp-admin/options-general.php.
Product
WhyDoWork AdSense
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update WhyDoWork AdSense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 16, 2014The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters inCVE-2014-8949 · WordPress plugins & themes · reported by MITREMedium 6
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4w_trace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE: it is not clear whether this issue itself crosses privileges.
Product
iMember360 plugin 3.8.012
Affected
up to 3.9.001
What to do
Affects up to 3.9.001. Update iMember360 plugin 3.8.012 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: SQL injectionCVE-2014-7959 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
What to do
Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Cross-site scripting (XSS)CVE-2014-7958 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
What to do
Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 21, 2014SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commandsCVE-2014-8375 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php.
Product
GB Gallery Slideshow
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com homelab.it
Oct 17, 2014Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators toCVE-2014-2995 · WordPress plugins & themes · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget
Fixed in
3.3.3
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 26, 2014Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote CVE-2014-6445 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) uE or (2) uC parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.g0blin.co.uk wordpress.org
Sep 22, 2014SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authentiCVE-2014-7153 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php.
Product
Huge-IT Image Gallery
Affected
1.0.1 to 1.0.1
What to do
Affects 1.0.1 to 1.0.1. Update Huge-IT Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 6, 2014SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrarCVE-2014-5186 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogallery_videos page to wp-admin/admin.php.
Product
All Video Gallery (all-video-gallery)
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update All Video Gallery (all-video-gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute aCVE-2014-5184 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the story parameter in an edit action to wp-admin/admin.php.
Product
stripShow
Affected
2.5.2 to 2.5.2
What to do
Affects 2.5.2 to 2.5.2. Update stripShow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 11, 2014The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinCVE-2014-4942 · WordPress plugins & themes · reported by MITREMedium 5
The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
Product
EasyCart (wp-easycart)
Fixed in
2.0.6
What to do
Update EasyCart (wp-easycart) to 2.0.6 or newer.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Jul 11, 2014SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQCVE-2014-4939 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php.
Product
ENL Newsletter (enl-newsletter)
Affected
1.0.1 to 1.0.1
What to do
Affects 1.0.1 to 1.0.1. Update ENL Newsletter (enl-newsletter) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in admin/admin_show_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows remote attackers to inCVE-2014-4582 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin_show_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the dialog_id parameter.
Product
WP Consultant
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Consultant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress allows remote attacCVE-2014-4532 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Product
Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale
Fixed in
1.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale to 1.2.3 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in xencarousel-admin.js.php in the XEN Carousel plugin 0.12.2 and earlier for WordPress allow remote attackeCVE-2014-4602 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in xencarousel-admin.js.php in the XEN Carousel plugin 0.12.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) ajaxpath parameter.
Product
XEN Carousel
Affected
up to 0.12.2
What to do
Affects up to 0.12.2. Update XEN Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in admin/editFacility.php in the wp-easybooking plugin 1.0.3 and earlier for WordPress allows remote attackers to injecCVE-2014-4584 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/editFacility.php in the wp-easybooking plugin 1.0.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the fID parameter.
Product
wp-easybooking
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update wp-easybooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 CVE-2014-4528 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) promo_type, (2) fb_edit_action, or (3) promo_id parameter.
Product
Bugs Go Viral : Facebook Promotion Generator (fbpromotions)
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Bugs Go Viral : Facebook Promotion Generator (fbpromotions) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jun 25, 2014Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of adminCVE-2014-4030 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php.
Product
Cross-site request forgery (CSRF) vulnerability in the JW Player
Fixed in
2.1.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the JW Player to 2.1.4 or newer.
Full record and what to do →NVD record seclists.org secunia.com
Jun 11, 2014Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of adminCVE-2014-3850 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to wp-admin/options-general.php.
Product
Member Approval
Affected
131109 to 131109
What to do
Affects 131109 to 131109. Update Member Approval to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org security.dxw.com
May 14, 2014Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to CVE-2013-2700 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125
Fixed in
1.5.0
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 to 1.5.0 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
May 8, 2014Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated uCVE-2014-3123 · WordPress plugins & themes · reported by MITRELow 2.1
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
Product
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery
Fixed in
1.19.18
What to do
Update Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery to 1.19.18 or newer.
Full record and what to do →NVD record secunia.com securityfocus.com
May 6, 2014The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \'CVE-2014-2558 · WordPress plugins & themes · reported by MITREMedium 6.5
The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.
Product
File Gallery
Fixed in
1.7.9.2
What to do
Update File Gallery to 1.7.9.2 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Apr 25, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administCVE-2014-2579 · WordPress plugins & themes · reported by MITREHigh 7.6
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands.
Product
generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner
Affected
up to 3.5
What to do
Affects up to 3.5. Update generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Apr 11, 2014Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authentication of administCVE-2013-2708 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Product
Content Slide
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update Content Slide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 10, 2014Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijackCVE-2013-3252 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews
Fixed in
1.63
What to do
Update Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews to 1.63 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 9, 2014WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includeCVE-2014-0165 · WordPress plugins & themes · reported by Red HatMedium 4
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Fixed in
3.7.2
What to do
Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD record codex.wordpress.org codex.wordpress.org
Apr 7, 2014Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows CVE-2012-1834 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php.
Product
Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View
Fixed in
0.8.9
What to do
Update Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View to 0.8.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Apr 3, 2014Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of adminisCVE-2014-2340 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.
Product
Cross-site request forgery (CSRF) vulnerability in the XCloner
Fixed in
3.1.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the XCloner to 3.1.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 24, 2014Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrarCVE-2013-1408 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Product
Multiple SQL injection vulnerabilities in the Wysija Newsletters
Fixed in
2.2.1
What to do
Update Multiple SQL injection vulnerabilities in the Wysija Newsletters to 2.2.1 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Jan 20, 2014wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated userCVE-2012-6635 · WordPress plugins & themes · reported by MITREMedium 4
wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft.
Fixed in
3.3.3
What to do
Update the plugin to 3.3.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions viaCVE-2012-6634 · WordPress plugins & themes · reported by MITREMedium 6.4
wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.
Fixed in
3.3.3
What to do
Update the plugin to 3.3.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform CVE-2011-5270 · WordPress plugins & themes · reported by MITREMedium 4
wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role.
Fixed in
3.0.6
What to do
Update the plugin to 3.0.6 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might alloCVE-2010-5297 · WordPress plugins & themes · reported by MITRELow 2.1
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Fixed in
3.0.1
What to do
Update the plugin to 3.0.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capabCVE-2010-5296 · WordPress plugins & themes · reported by MITREMedium 4.9
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
Fixed in
3.0.2
What to do
Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML: Cross-site scripting (XSS)CVE-2010-5295 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.
Product
wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML
Fixed in
3.0.2
What to do
Update wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allowCVE-2010-5294 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a (1) FTP or (2) SSH connection attempt.
Fixed in
3.0.2
What to do
Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 16, 2014Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to injeCVE-2012-6627 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbiCVE-2012-6625 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action.
Product
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server
Fixed in
1.7.4
What to do
Update SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server to 1.7.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org wordpress.org
Jan 16, 2014Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackeCVE-2012-6623 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server
Fixed in
1.7.5
What to do
Update Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server to 1.7.5 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote atCVE-2012-6622 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action.
Product
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server
Fixed in
1.7.4
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server to 1.7.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Dec 29, 2013the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier: Cross-site request forgery (CSRF)CVE-2013-7233 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.
Product
the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org osvdb.org
Dec 23, 2013Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in thCVE-2013-7102 · WordPress plugins & themes · reported by Red HatMedium 6.8
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.
Fixed in
1.61
What to do
Update the plugin to 1.61 or newer.
Full record and what to do →NVD record blog.sucuri.net help.optimizepress.com
Sep 17, 2013Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackCVE-2013-5711 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System
Fixed in
3.7
What to do
Update Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System to 3.7 or newer.
Full record and what to do →NVD record archives.neohapsis.com wordpress.org
Sep 12, 2013wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and proviCVE-2013-4340 · WordPress plugins & themes · reported by Red HatLow 3.5
wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.
Fixed in
3.6.1
What to do
Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Sep 4, 2013Cross-site request forgery (CSRF) vulnerability in the ShareThis plugin before 7.0.6 for WordPress allows remote attackers to hijack the authentication of adminCVE-2013-3479 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the ShareThis plugin before 7.0.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the ShareThis
Fixed in
7.0.6
What to do
Update Cross-site request forgery (CSRF) vulnerability in the ShareThis to 7.0.6 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-5098 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-3262 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.