Updated 10 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,993 results · page 23 of 40

Jun 18, 2020A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order paCVE-2020-13640 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)
Product
gVectors wpDiscuz
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update gVectors wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com plugins.trac.wordpress.org
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.CVE-2019-19112 · WordPress plugins & themes · reported by MITREMedium 6.1
The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.CVE-2019-19111 · WordPress plugins & themes · reported by MITREMedium 6.1
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.CVE-2019-19110 · WordPress plugins & themes · reported by MITREMedium 4.8
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.CVE-2019-19109 · WordPress plugins & themes · reported by MITREHigh 8.8
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
Jun 12, 2020In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved.CVE-2020-4050 · WordPress plugins & themes · reported by GitHubLow 3.5
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 10, 2020The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.CVE-2020-14010 · WordPress plugins & themes · reported by MITREMedium 6.1
The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.
Affected
1.3 to 1.3
What to do
Affects 1.3 to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record knassar702.github.io knassar702.github.io
Jun 9, 2020The SportsPress plugin before 2.7.2 for WordPress allows XSS.CVE-2020-13892 · WordPress plugins & themes · reported by MITREMedium 5.4
The SportsPress plugin before 2.7.2 for WordPress allows XSS.
Product
SportsPress
Fixed in
2.7.2
What to do
Update SportsPress to 2.7.2 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Jun 8, 2020The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting sCVE-2020-12800 · WordPress plugins & themes · reported by MITRECritical 9.8
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.
Product
drag-and-drop-multiple-file-upload-contact-form-7
Fixed in
1.3.3.3
What to do
Update drag-and-drop-multiple-file-upload-contact-form-7 to 1.3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Jun 2, 2020The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective SerCVE-2019-11843 · WordPress plugins & themes · reported by MITREMedium 6.1
The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).
Product
MailPoet
Fixed in
3.23.2
What to do
Update MailPoet to 3.23.2 or newer.
Full record and what to do →NVD record github.com pluginarchive.com
May 6, 2020A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject aCVE-2020-11727 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.
Product
AlgolPlus Advanced Order Export For WooCommerce
Affected
3.1.3 to 3.1.3
What to do
Affects 3.1.3 to 3.1.3. Update AlgolPlus Advanced Order Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Apr 29, 2020The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.CVE-2020-12462 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
Product
ninja-forms
Fixed in
3.4.24.2
What to do
Update ninja-forms to 3.4.24.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 23, 2020The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query).CVE-2020-12054 · WordPress plugins & themes · reported by MITREMedium 6.1
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.
Product
Catch Breadcrumb
Fixed in
1.5.4
What to do
Update Catch Breadcrumb to 1.5.4 or newer.
Full record and what to do →NVD record cxsecurity.com wpvulndb.com
Apr 22, 2020The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.CVE-2020-12074 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.
Product
users-customers-import-export-for-wp-woocommerce
Fixed in
1.3.9
What to do
Update users-customers-import-export-for-wp-woocommerce to 1.3.9 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript viCVE-2020-11509 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page).
Product
An XSS vulnerability in the WP Lead Plus X
Affected
up to 0.98
What to do
Affects up to 0.98. Update An XSS vulnerability in the WP Lead Plus X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pagesCVE-2020-11508 · WordPress plugins & themes · reported by MITREMedium 5.4
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pages with a malicious page containing arbitrary JavaScript via the wp_ajax_core37_lp_save_page (aka core37_lp_save_page) AJAX action.
Product
An XSS vulnerability in the WP Lead Plus X
Affected
up to 0.98
What to do
Affects up to 0.98. Update An XSS vulnerability in the WP Lead Plus X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScrCVE-2020-11516 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
Product
Stored XSS in the Contact Form 7 Datepicker
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Stored XSS in the Contact Form 7 Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the uCVE-2020-11515 · WordPress plugins & themes · reported by MITREMedium 6.1
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
Product
Rank Math
Affected
up to 1.0.40.2
What to do
Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record rankmath.com wordpress.org
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escCVE-2020-11514 · WordPress plugins & themes · reported by MITRECritical 9.8
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
Product
Rank Math
Affected
up to 1.0.40.2
What to do
Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record rankmath.com wordpress.org
Apr 7, 2020Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrCVE-2020-11512 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts.
Product
IMPress for IDX Broker
Fixed in
2.6.2
What to do
Update IMPress for IDX Broker to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 4, 2020The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula.CVE-2020-11548 · WordPress plugins & themes · reported by MITRECritical 9.8
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
Product
Search Meter
Affected
up to 2.13.2
What to do
Affects up to 2.13.2. Update Search Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org exploit-db.com
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.CVE-2019-17230 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
Product
includes/theme-functions.php in the OneTone
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Apr 1, 2020The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.CVE-2020-6753 · WordPress plugins & themes · reported by MITREMedium 6.1
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.
Product
Login by Auth0
Fixed in
4.0.0
What to do
Update Login by Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com github.com
Mar 27, 2020The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection.CVE-2020-10817 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
Product
custom-searchable-data-entry-system (aka Custom Searchable Data Entry System)
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avveng.com plugins.trac.wordpress.org
Mar 20, 2020An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitraryCVE-2019-13463 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the "echo get_the_title()" or "echo $term->name" statement.
Product
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory
Fixed in
7.3.5
What to do
Update An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory to 7.3.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 17, 2020The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.CVE-2018-18576 · WordPress plugins & themes · reported by MITREMedium 5.3
The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.
Product
Hustle (aka wordpress-popup)
Affected
up to 6.0.5
What to do
Affects up to 6.0.5. Update Hustle (aka wordpress-popup) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pastebin.com wordpress.org
Mar 16, 2020be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role viCVE-2020-7916 · WordPress plugins & themes · reported by MITREMedium 6.5
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
Product
LearnPress
Affected
up to 3.2.6.5
What to do
Affects up to 3.2.6.5. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2020An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an CVE-2020-10196 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several of the popup's fields by sending a request to wp-admin/admin-ajax.php with the POST action parameter of sgpb_autosave and including additional data in an allPopupData parameter, including the popup's ID (which is visible in the source of the page in which the popup is inserted) and arbitrary JavaScript which will then be executed in the browsers of visitors to that page. Because the plugin functionality automatically adds script tags to data entered into these fields, this injection will typically bypass most WAF applications.
Product
An XSS vulnerability in the popup-builder
Fixed in
3.64.1
What to do
Update An XSS vulnerability in the popup-builder to 3.64.1 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Mar 13, 2020The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via adminCVE-2020-10195 · WordPress plugins & themes · reported by MITREMedium 6.3
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.
Product
popup-builder
Fixed in
3.64.1
What to do
Update popup-builder to 3.64.1 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Mar 10, 2020controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via tCVE-2018-14502 · WordPress plugins & themes · reported by MITRECritical 9.8
controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.
Product
controllers/quizzes.php in the Kiboko Chained Quiz
Fixed in
1.0.9
What to do
Update controllers/quizzes.php in the Kiboko Chained Quiz to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submittCVE-2020-9458 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and chaCVE-2020-9457 · WordPress plugins & themes · reported by MITREHigh 8.8
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their CVE-2020-9456 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of theCVE-2020-9455 · WordPress plugins & themes · reported by MITREMedium 4.3
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator tCVE-2020-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
Product
A CSRF vulnerability in the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update A CSRF vulnerability in the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 4, 2020The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formCVE-2020-9372 · WordPress plugins & themes · reported by MITREHigh 7.8
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
Product
Appointment Booking Calendar
Fixed in
1.3.35
What to do
Update Appointment Booking Calendar to 1.3.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com drive.google.com
Feb 28, 2020Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticaCVE-2020-9459 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.
Product
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Feb 28, 2020The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.CVE-2020-9466 · WordPress plugins & themes · reported by MITREMedium 6.1
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.
Product
Export Users to CSV
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Export Users to CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com getastra.com
Feb 26, 2020The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufCVE-2019-19134 · WordPress plugins & themes · reported by MITREMedium 6.1
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record heroplugins.com heroplugins.com
Feb 25, 2020The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.CVE-2020-9019 · WordPress plugins & themes · reported by MITREMedium 6.1
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
Affected
5.5.3 to 5.5.3
What to do
Affects 5.5.3 to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.ikiu.ac.ir uploadboy.com
Feb 24, 2020includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unautCVE-2019-17228 · WordPress plugins & themes · reported by MITREMedium 6.5
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
Product
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads)
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Feb 17, 2020The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.CVE-2020-9043 · WordPress plugins & themes · reported by MITREHigh 8.8
The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.
Product
wpCentral
Fixed in
1.5.1
What to do
Update wpCentral to 1.5.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 17, 2020Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php.CVE-2020-6850 · WordPress plugins & themes · reported by MITREMedium 6.1
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.
Product
Utilities.php in the miniorange-saml-20-single-sign-on
Fixed in
4.8.84
What to do
Update Utilities.php in the miniorange-saml-20-single-sign-on to 4.8.84 or newer.
Full record and what to do →NVD record wordpress.org zeroauth.ltd
Feb 5, 2020The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF.CVE-2020-8658 · WordPress plugins & themes · reported by MITREHigh 8.8
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.
Product
BestWebSoft Htaccess
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update BestWebSoft Htaccess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Feb 5, 2020The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.CVE-2019-20173 · WordPress plugins & themes · reported by MITREMedium 6.1
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
Product
Auth0 wp-auth0 plugin 3.11.x
Fixed in
3.11.3
What to do
Update Auth0 wp-auth0 plugin 3.11.x to 3.11.3 or newer.
Full record and what to do →NVD record auth0.com github.com
Jan 28, 2020The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.CVE-2020-8417 · WordPress plugins & themes · reported by MITREHigh 8.8
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.
Product
Code Snippets
Fixed in
2.14.0
What to do
Update Code Snippets to 2.14.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 23, 2020WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.CVE-2012-6649 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.
Affected
1.1.21 to 1.1.21
What to do
Affects 1.1.21 to 1.1.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 21, 2020The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.CVE-2020-6849 · WordPress plugins & themes · reported by MITREHigh 8.8
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.
Product
marketo-forms-and-tracking
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update marketo-forms-and-tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 16, 2020The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.CVE-2020-7108 · WordPress plugins & themes · reported by MITREMedium 5.4
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
Product
LearnDash LMS
Fixed in
3.1.2
What to do
Update LearnDash LMS to 3.1.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com learndash.releasenotes.io
Jan 16, 2020The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.CVE-2020-7107 · WordPress plugins & themes · reported by MITREMedium 6.1
The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.
Product
Ultimate FAQ
Fixed in
1.8.30
What to do
Update Ultimate FAQ to 1.8.30 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.