Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,264 results · page 24 of 26

Sep 16, 2019The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.CVE-2016-10959 · WordPress plugins & themes · reported by MITREMedium 6.5
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
Product
estatik
Fixed in
2.3.1
What to do
Update estatik to 2.3.1 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Sep 16, 2019The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.CVE-2016-10958 · WordPress plugins & themes · reported by MITREHigh 7.5
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.
Product
estatik
Fixed in
2.3.0
What to do
Update estatik to 2.3.0 or newer.
Full record and what to do →NVD record estatik.net wordpress.org
Sep 13, 2019The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.CVE-2016-10955 · WordPress plugins & themes · reported by MITRECritical 9.8
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
Product
cysteme-finder
Fixed in
1.4
What to do
Update cysteme-finder to 1.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 13, 2019The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.CVE-2016-10954 · WordPress plugins & themes · reported by MITRECritical 9.8
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
Product
Neosense
Fixed in
1.8
What to do
Update Neosense to 1.8 or newer.
Full record and what to do →NVD record lifeforms.nl wpvulndb.com
Sep 13, 2019The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.CVE-2016-10943 · WordPress plugins & themes · reported by MITREHigh 7.2
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 11, 2019WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.CVE-2019-16217 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org lists.debian.org
Sep 3, 2019The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.CVE-2019-15866 · WordPress plugins & themes · reported by MITREHigh 8.8
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.
Product
crelly-slider
Fixed in
1.3.5
What to do
Update crelly-slider to 1.3.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.CVE-2019-15842 · WordPress plugins & themes · reported by MITREMedium 6.1
The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
Product
easy-pdf-restaurant-menu-upload
Fixed in
1.1.2
What to do
Update easy-pdf-restaurant-menu-upload to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 30, 2019The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301CVE-2019-15818 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
Product
simple-301-redirects-addon-bulk-uploader
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update simple-301-redirects-addon-bulk-uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 29, 2019The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.CVE-2019-15776 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
Product
simple-301-redirects-addon-bulk-uploader
Fixed in
1.2.5
What to do
Update simple-301-redirects-addon-bulk-uploader to 1.2.5 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.CVE-2018-21007 · WordPress plugins & themes · reported by MITRECritical 9.8
The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.
Product
woo-confirmation-email
Fixed in
3.2.0
What to do
Update woo-confirmation-email to 3.2.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.CVE-2017-18592 · WordPress plugins & themes · reported by MITREHigh 7.5
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
Product
woocommerce-catalog-enquiry
Fixed in
3.1.0
What to do
Update woocommerce-catalog-enquiry to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.CVE-2019-15649 · WordPress plugins & themes · reported by MITREHigh 8.8
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
Product
insert-or-embed-articulate-content-into-wordpress
Fixed in
4.2999
What to do
Update insert-or-embed-articulate-content-into-wordpress to 4.2999 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.CVE-2016-10929 · WordPress plugins & themes · reported by MITREMedium 5.3
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
Product
advanced-ajax-page-loader
Fixed in
2.7.7
What to do
Update advanced-ajax-page-loader to 2.7.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess fCVE-2015-9340 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
Product
wp-file-upload
Fixed in
3.0.0
What to do
Update wp-file-upload to 3.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.CVE-2015-9339 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
Product
wp-file-upload
Fixed in
2.7.1
What to do
Update wp-file-upload to 2.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.CVE-2015-9338 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
Product
wp-file-upload
Fixed in
2.5.0
What to do
Update wp-file-upload to 2.5.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.CVE-2015-9341 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
Product
wp-file-upload
Fixed in
3.4.1
What to do
Update wp-file-upload to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.CVE-2018-20971 · WordPress plugins & themes · reported by MITREHigh 8.8
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
Product
church-admin
Fixed in
1.2550
What to do
Update church-admin to 1.2550 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.CVE-2019-14794 · WordPress plugins & themes · reported by MITREHigh 7.5
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.
Product
Meta Box
Fixed in
4.16.2
What to do
Update Meta Box to 4.16.2 or newer.
Full record and what to do →NVD record metabox.io metabox.io
Jun 3, 2019The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.CVE-2019-11185 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
Product
WP Live Chat Support Pro
Affected
up to 8.0.26
What to do
Affects up to 8.0.26. Update WP Live Chat Support Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wp-livechat.com
May 7, 2019Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated).CVE-2019-10869 · WordPress plugins & themes · reported by MITREHigh 8.1
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
Product
Path Traversal and Unrestricted File Upload exists in the Ninja Forms
Fixed in
3.0.23
What to do
Update Path Traversal and Unrestricted File Upload exists in the Ninja Forms to 3.0.23 or newer.
Full record and what to do →NVD record wpscan.com wpvulndb.com
Apr 18, 2019An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading CVE-2019-11223 · WordPress plugins & themes · reported by MITRECritical 9.8
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Product
An Unrestricted File Upload Vulnerability in the SupportCandy
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update An Unrestricted File Upload Vulnerability in the SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.kalasag.com.ph wordpress.org
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating fCVE-2015-4617 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.
Affected
1.09 to 1.09
What to do
Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictiCVE-2018-20149 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Oct 17, 2018In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the ChatCVE-2018-18373 · WordPress plugins & themes · reported by MITREMedium 5.4
In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sb_ajax_add_message action.
Product
Schiocco "Support Board - Chat And Help Desk
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update Schiocco "Support Board - Chat And Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Oct 5, 2018The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safCVE-2015-9272 · WordPress plugins & themes · reported by MITRECritical 9.8
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Affected
3.31.17 to 3.31.17
What to do
Affects 3.31.17 to 3.31.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com openwall.com
Oct 4, 2018The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.phCVE-2015-9271 · WordPress plugins & themes · reported by MITRECritical 9.8
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
Affected
4.91.8 to 4.91.8
What to do
Affects 4.91.8 to 4.91.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com vapidlabs.com
Sep 28, 2018The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editCVE-2018-17573 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editor/filemanager/browser/default/browser.html, fckeditor/editor/filemanager/connectors/test.html, and fckeditor/editor/filemanager/connectors/uploadtest.html.
Product
Wp-Insert
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Wp-Insert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cxsecurity.com packetstormsecurity.com
Aug 10, 2018In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files.CVE-2018-14028 · WordPress plugins & themes · reported by MITREHigh 7.2
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does have the required capabilities for plugin uploads) cannot simply place arbitrary PHP code into a valid plugin ZIP file and upload that plugin, because a machine's wp-content/plugins directory permissions were set up to block all new plugins.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com core.trac.wordpress.org
May 14, 2018Ultimate Member plugin prior to version 2.0.4 for: Unrestricted file uploadCVE-2018-0587 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.
Product
Ultimate Member plugin prior to version 2.0.4 for
Fixed in
2.0.4
What to do
Update Ultimate Member plugin prior to version 2.0.4 for to 2.0.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 25, 2018The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters iCVE-2014-5014 · WordPress plugins & themes · reported by MITRECritical 9.8
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
Product
WordPress Flash Uploader
Fixed in
3.1.3
What to do
Update WordPress Flash Uploader to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 7, 2018The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.CVE-2018-9844 · WordPress plugins & themes · reported by MITREMedium 6.1
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.
Product
Iptanus WordPress File Upload
Fixed in
4.3.4
What to do
Update Iptanus WordPress File Upload to 4.3.4 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Apr 1, 2018The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.CVE-2018-9172 · WordPress plugins & themes · reported by MITREMedium 5.4
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.
Product
Iptanus WordPress File Upload
Fixed in
4.3.3
What to do
Update Iptanus WordPress File Upload to 4.3.3 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Mar 7, 2018inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt.CVE-2018-7204 · WordPress plugins & themes · reported by MITREHigh 7.5
inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and contains database credentials, salts, etc. These files have been indexed by Google and a simple dork will find affected sites.
Product
inc/logger.php in the Giribaz File Manager
Fixed in
5.0.2
What to do
Update inc/logger.php in the Giribaz File Manager to 5.0.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 16, 2018core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitizeCVE-2018-6944 · WordPress plugins & themes · reported by MITREMedium 6.1
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
Product
UltimateMember
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update UltimateMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Feb 16, 2018core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitizCVE-2018-6943 · WordPress plugins & themes · reported by MITREMedium 6.1
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
Product
UltimateMember
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update UltimateMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Jan 8, 2018Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploCVE-2014-4972 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
Product
Gravity Upload Ajax
Affected
up to 1.1
What to do
Affects up to 1.1. Update Gravity Upload Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record g0blin.co.uk wpvulndb.com
Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.phCVE-2018-5213 · WordPress plugins & themes · reported by MITREMedium 5.4
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
Product
Simple Download Monitor
Fixed in
3.5.4
What to do
Update Simple Download Monitor to 3.5.4 or newer.
Full record and what to do →NVD record github.com github.com
Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/CVE-2018-5212 · WordPress plugins & themes · reported by MITREMedium 5.4
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.
Product
Simple Download Monitor
Fixed in
3.5.4
What to do
Update Simple Download Monitor to 3.5.4 or newer.
Full record and what to do →NVD record github.com github.com
Dec 2, 2017wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers CVE-2017-17092 · WordPress plugins & themes · reported by MITREMedium 5.4
wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.
Fixed in
4.9.1
What to do
Update the plugin to 4.9.1 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Nov 17, 2017The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/adCVE-2017-16871 · WordPress plugins & themes · reported by MITREHigh 8.1
The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary
Product
UpdraftPlus
Affected
up to 1.13.12
What to do
Affects up to 1.13.12. Update UpdraftPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Oct 19, 2017The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, reCVE-2015-6668 · WordPress plugins & themes · reported by MITREHigh 7.5
The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.
Product
Job Manager
Fixed in
0.7.25
What to do
Update Job Manager to 0.7.25 or newer.
Full record and what to do →NVD record vagmour.eu wpvulndb.com
Sep 12, 2017In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extensionCVE-2015-9228 · WordPress plugins & themes · reported by MITREHigh 8.8
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
Product
Photocrati NextGEN Gallery
What to do
Update Photocrati NextGEN Gallery to the newest version.
Full record and what to do →NVD record openwall.com cybersecurityworks.com
May 23, 2017upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variabCVE-2015-5682 · WordPress plugins & themes · reported by MITREHigh 7.5
upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com vapid.dhs.org
May 23, 2017Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote atCVE-2015-4455 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
Product
Aviary Image Editor Add-on For Gravity Forms
Affected
up to 3.0
What to do
Affects up to 3.0. Update Aviary Image Editor Add-on For Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com vapid.dhs.org
May 18, 2017In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not propCVE-2017-9061 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 2, 2017Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.CVE-2017-6104 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
Affected
up to 3.0
What to do
Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Jan 4, 2017Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPCVE-2016-7169 · WordPress plugins & themes · reported by MITREMedium 6.3
Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jan 4, 2017Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackeCVE-2016-7168 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record debian.org openwall.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.