Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,068 results · page 22 of 22
Feb 21, 2018The Ninja Forms plugin before 3.2.14 for WordPress has XSS.CVE-2018-7280 · WordPress plugins & themes · reported by MITREMedium 6.1
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
- Product
- Ninja Forms
- Fixed in
- 3.2.14
- What to do
- Update Ninja Forms to 3.2.14 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 1, 2018The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameCVE-2017-18010 · WordPress plugins & themes · reported by MITREMedium 6.1
The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.
- Product
- E-goi Smart Marketing SMS and Newsletters Forms
- Fixed in
- 2.0.0
- What to do
- Update E-goi Smart Marketing SMS and Newsletters Forms to 2.0.0 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Jul 17, 2017Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in CVE-2017-1000033 · WordPress plugins & themes · reported by MITREMedium 6.1
Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2017Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote atCVE-2015-4455 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
- Product
- Aviary Image Editor Add-on For Gravity Forms
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Aviary Image Editor Add-on For Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comvapid.dhs.org
May 14, 2016The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST reqCVE-2016-1209 · WordPress plugins & themes · reported by vultures@jpcert.or.jpCritical 9.8
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
- Product
- Ninja Forms
- Fixed in
- 2.9.42.1
- What to do
- Update Ninja Forms to 2.9.42.1 or newer.
Jan 8, 2016Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTCVE-2014-7151 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the form_fields parameter in a (1) do_edit or (2) do_insert action to wp-admin/admin-ajax.php.
- Product
- NEX-Forms Lite
- Affected
- 2.1.0 to 2.1.0
- What to do
- Affects 2.1.0 to 2.1.0. Update NEX-Forms Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordresearch.g0blin.co.ukwpvulndb.com
Aug 18, 2015Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbCVE-2015-5481 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
- Product
- Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments
- Fixed in
- 2.3
- What to do
- Update Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments to 2.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 5, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web scriCVE-2015-2220 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms
- Fixed in
- 2.8.9
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms to 2.8.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Mar 5, 2015Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.CVE-2014-9688 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
- Product
- Unspecified vulnerability in the Ninja Forms
- Fixed in
- 2.8.10
- What to do
- Update Unspecified vulnerability in the Ninja Forms to 2.8.10 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 7, 2015Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary codCVE-2014-9473 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the cf_uploadfile2[] parameter, then accessing the file via a direct request to the file in the default upload directory.
- Product
- CformsII
- Affected
- up to 14.7
- What to do
- Affects up to 14.7. Update CformsII to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comwordpress.org
Sep 26, 2014Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web scriCVE-2014-7152 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the update_options action to wp-admin/admin-ajax.php.
- Product
- Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordresearch.g0blin.co.ukwordpress.org
Sep 26, 2014The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary fiCVE-2014-6446 · WordPress plugins & themes · reported by MITREHigh 7.5
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
- Product
- Infusionsoft Gravity Forms plugin 1.5.3
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update Infusionsoft Gravity Forms plugin 1.5.3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier for WordPress allow CVE-2014-4599 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) search_term, (3) page_id, (4) page, or (5) page_links parameter.
- Product
- WP-Business Directory (wp-ttisbdir)
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP-Business Directory (wp-ttisbdir) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allCVE-2014-4583 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) order_direction, (3) limit_start, (4) id, or (5) order parameter.
- Product
- WP-Contact (wp-contact-sidebar-widget)
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP-Contact (wp-contact-sidebar-widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
May 22, 2014SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated userCVE-2014-3210 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the booking_form_id parameter to wp-admin/admin-ajax.php.
- Product
- SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar)
- Fixed in
- 1.3
- What to do
- Update SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) to 1.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Jun 15, 2012includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for: Unrestricted file uploadCVE-2012-3574 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/temp.
- Product
- includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for
- What to do
- Update includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for to the newest version.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Nov 3, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject aCVE-2010-3977 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecunia.comconviso.com.br
Feb 4, 2008cforms-css.php in Oliver Seidel cforms: PHP remote file inclusionCVE-2008-0560 · WordPress plugins & themes · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in cforms-css.php in Oliver Seidel cforms (contactforms), a Wordpress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the tm parameter. NOTE: CVE disputes this issue for 7.3, since there is no tm parameter, and the code exits with a fatal error due to a call to an undefined function
- Product
- cforms-css.php in Oliver Seidel cforms
- What to do
- Update cforms-css.php in Oliver Seidel cforms to the newest version.
Full record and what to do →NVD recordsecurityreason.comattrition.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.