Updated 36 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,126 results · page 22 of 23

Apr 9, 2014WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includeCVE-2014-0165 · WordPress plugins & themes · reported by Red HatMedium 4
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Fixed in
3.7.2
What to do
Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD record codex.wordpress.org codex.wordpress.org
Apr 7, 2014Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows CVE-2012-1834 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php.
Product
Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View
Fixed in
0.8.9
What to do
Update Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View to 0.8.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Apr 3, 2014Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of adminisCVE-2014-2340 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.
Product
Cross-site request forgery (CSRF) vulnerability in the XCloner
Fixed in
3.1.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the XCloner to 3.1.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 24, 2014Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrarCVE-2013-1408 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Product
Multiple SQL injection vulnerabilities in the Wysija Newsletters
Fixed in
2.2.1
What to do
Update Multiple SQL injection vulnerabilities in the Wysija Newsletters to 2.2.1 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Jan 20, 2014wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated userCVE-2012-6635 · WordPress plugins & themes · reported by MITREMedium 4
wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft.
Fixed in
3.3.3
What to do
Update the plugin to 3.3.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions viaCVE-2012-6634 · WordPress plugins & themes · reported by MITREMedium 6.4
wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.
Fixed in
3.3.3
What to do
Update the plugin to 3.3.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform CVE-2011-5270 · WordPress plugins & themes · reported by MITREMedium 4
wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role.
Fixed in
3.0.6
What to do
Update the plugin to 3.0.6 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might alloCVE-2010-5297 · WordPress plugins & themes · reported by MITRELow 2.1
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Fixed in
3.0.1
What to do
Update the plugin to 3.0.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capabCVE-2010-5296 · WordPress plugins & themes · reported by MITREMedium 4.9
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
Fixed in
3.0.2
What to do
Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML: Cross-site scripting (XSS)CVE-2010-5295 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.
Product
wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML
Fixed in
3.0.2
What to do
Update wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allowCVE-2010-5294 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a (1) FTP or (2) SSH connection attempt.
Fixed in
3.0.2
What to do
Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 16, 2014Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to injeCVE-2012-6627 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbiCVE-2012-6625 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action.
Product
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server
Fixed in
1.7.4
What to do
Update SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server to 1.7.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org wordpress.org
Jan 16, 2014Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackeCVE-2012-6623 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server
Fixed in
1.7.5
What to do
Update Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server to 1.7.5 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote atCVE-2012-6622 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action.
Product
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server
Fixed in
1.7.4
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server to 1.7.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Dec 29, 2013the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier: Cross-site request forgery (CSRF)CVE-2013-7233 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.
Product
the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org osvdb.org
Dec 23, 2013Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in thCVE-2013-7102 · WordPress plugins & themes · reported by Red HatMedium 6.8
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.
Fixed in
1.61
What to do
Update the plugin to 1.61 or newer.
Full record and what to do →NVD record blog.sucuri.net help.optimizepress.com
Sep 17, 2013Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackCVE-2013-5711 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System
Fixed in
3.7
What to do
Update Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System to 3.7 or newer.
Full record and what to do →NVD record archives.neohapsis.com wordpress.org
Sep 12, 2013wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and proviCVE-2013-4340 · WordPress plugins & themes · reported by Red HatLow 3.5
wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.
Fixed in
3.6.1
What to do
Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Sep 4, 2013Cross-site request forgery (CSRF) vulnerability in the ShareThis plugin before 7.0.6 for WordPress allows remote attackers to hijack the authentication of adminCVE-2013-3479 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the ShareThis plugin before 7.0.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the ShareThis
Fixed in
7.0.6
What to do
Update Cross-site request forgery (CSRF) vulnerability in the ShareThis to 7.0.6 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-5098 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-3262 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 9, 2013Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows remote attackers to hijCVE-2013-3253 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change unspecified settings.
Product
Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter
Fixed in
2.7.7
What to do
Update Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter to 2.7.7 or newer.
Full record and what to do →NVD record forum.xhanch.com plugins.trac.wordpress.org
Jun 1, 2013Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrCVE-2013-3261 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action.
Product
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery
Fixed in
2.72
What to do
Update Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery to 2.72 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 31, 2013Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb plugin before 1.9 for WordPress allows remote authenticated administrators to injecCVE-2013-3720 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb plugin before 1.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wp_post_id parameter.
Product
Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb
Fixed in
1.9
What to do
Update Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb to 1.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
May 10, 2013Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arCVE-2013-3254 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppa_manage_comments edit action.
Product
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus
Fixed in
5.0.3
What to do
Update Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus to 5.0.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Dec 27, 2012WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discoverCVE-2012-5868 · WordPress plugins & themes · reported by MITRELow 2.6
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record whiteoaksecurity.com whiteoaksecurity.com
Dec 20, 2012The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct reqCVE-2012-5469 · WordPress plugins & themes · reported by MITREHigh 7.5
The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod.
Product
Portable phpMyAdmin
Fixed in
1.3.1
What to do
Update Portable phpMyAdmin to 1.3.1 or newer.
Full record and what to do →NVD record archives.neohapsis.com wordpress.org
Oct 24, 2012Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to injecCVE-2012-5388 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.
Product
White Label CMS
What to do
Update White Label CMS to the newest version.
Full record and what to do →NVD record packetstormsecurity.org wordpress.org
Oct 8, 2012Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote CVE-2012-5327 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) delete_usrgrp[] parameter in a delete_usergroups action, (2) usergroup parameter in an add_user_togroup action, or (3) add_forum_group_id parameter in an add_forum_submit action.
Product
Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions
Fixed in
1.0.33
What to do
Update Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions to 1.0.33 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Oct 4, 2012admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31: Cross-site scripting (XSS)CVE-2011-5207 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 allows remote attackers to inject arbitrary web script or HTML via the tcp_name_post_XXXXX parameter.
Product
admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31
Fixed in
1.1.6
What to do
Update admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 to 1.1.6 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Sep 28, 2012wp-admin/index.php in WordPress 3.4.2: Cross-site request forgery (CSRF)CVE-2012-4448 · WordPress plugins & themes · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action.
Product
wp-admin/index.php in WordPress 3.4.2
What to do
Update wp-admin/index.php in WordPress 3.4.2 to the newest version.
Full record and what to do →NVD record openwall.com packetstormsecurity.org
Sep 14, 2012wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a nCVE-2012-4422 · WordPress plugins & themes · reported by Red HatLow 3.5
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.
Fixed in
3.4.2
What to do
Update the plugin to 3.4.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Aug 29, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script oCVE-2011-5128 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, or (3) inc-options/im_export_options.php, or the (4) post or (5) post_ID parameters to adminimize.php, different vectors than CVE-2011-4926.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize
Fixed in
1.7.22
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize to 1.7.22 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 29, 2012Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to injecCVE-2011-4926 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Product
Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize
Fixed in
1.7.22
What to do
Update Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize to 1.7.22 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 23, 2012wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for: Cross-site scripting (XSS)CVE-2011-5104 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are obtained from third party information.
Product
wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for
What to do
Update wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for to the newest version.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Aug 13, 2012Multiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordCVE-2012-4271 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) httpbl_key, (3) httpbl_maxage, (4) httpbl_threat, (5) reverse_proxy_addresses, or (6) reverse_proxy_header parameter.
Fixed in
2.0.47
What to do
Update the plugin to 2.0.47 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Aug 13, 2012bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for: Cross-site scripting (XSS)CVE-2012-4268 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_ACCEPT_ENCODING header.
Product
bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for
What to do
Update bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Aug 13, 2012Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remoteCVE-2012-4263 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_USER_AGENT header.
Product
Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security)
Fixed in
3.2.5
What to do
Update Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) to 3.2.5 or newer.
Full record and what to do →NVD record bit51.com packetstormsecurity.org
May 21, 2012Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-2916 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the active_option parameter to wp-admin/tools.php.
Product
Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE
Fixed in
2.1
What to do
Update Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE to 2.1 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Apr 21, 2012wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-widCVE-2012-2402 · WordPress plugins & themes · reported by MITREMedium 5.5
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org osvdb.org
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL databasCVE-2012-0937 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 30, 2012Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attacCVE-2012-0782 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate,CVE-2011-4899 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameteCVE-2011-4898 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Nov 28, 2011Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WCVE-2011-4562 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.
Product
Redirection
What to do
Update Redirection to the newest version.
Full record and what to do →NVD record dotxed.net osvdb.org
Aug 10, 2011WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, whicCVE-2011-3127 · WordPress plugins & themes · reported by MITREMedium 5.8
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 14, 2011wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a mCVE-2011-0701 · WordPress plugins & themes · reported by Red HatMedium 4
wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.
Fixed in
3.0.5
What to do
Update the plugin to 3.0.5 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 25, 2011Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitraCVE-2011-0641 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
StatPressCN
What to do
Update StatPressCN to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 30, 2010Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to CVE-2010-4630 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Product
WP Survey And Quiz Tool
What to do
Update WP Survey And Quiz Tool to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.