Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

12,551 results · page 241 of 252

Jul 5, 2019Online Lesson Booking 0.8.6 and earlier: Cross-site scriptingCVE-2019-5972 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Online Lesson Booking 0.8.6 and earlier
Affected
up to 0.8.6
What to do
Affects up to 0.8.6. Update Online Lesson Booking 0.8.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp olbsys.com
Jul 5, 2019Attendance Manager 0.5.6 and earlier: Cross-site scriptingCVE-2019-5970 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Attendance Manager 0.5.6 and earlier
Affected
up to 0.5.6
What to do
Affects up to 0.5.6. Update Attendance Manager 0.5.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record attmgr.com jvn.jp
Jul 5, 2019Zoho SalesIQ 1.0.8 and earlier: Cross-site scriptingCVE-2019-5962 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Zoho SalesIQ 1.0.8 and earlier
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Zoho SalesIQ 1.0.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
May 13, 2019Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web scripCVE-2019-7411 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL).
Product
MyThemeShop Launcher
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update MyThemeShop Launcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record metamorfosec.com wpvulndb.com
May 13, 2019pageflipbook.php script from index.php in Page Flip Book plugin for: Directory traversalCVE-2012-6652 · WordPress plugins & themes · reported by MITRECritical 9.8
Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pageflipbook_language parameter.
Product
pageflipbook.php script from index.php in Page Flip Book plugin for
What to do
Update pageflipbook.php script from index.php in Page Flip Book plugin for to the newest version.
Full record and what to do →NVD record ceriksen.com wordpress.org
Apr 23, 2019The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GETCVE-2019-10864 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
Product
WP Statistics
Affected
up to 12.6.2
What to do
Affects up to 12.6.2. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com medium.com
Apr 1, 2019pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionCoCVE-2019-6715 · WordPress plugins & themes · reported by MITREHigh 7.5
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.
Product
pub/sns.php in the W3 Total Cache
Fixed in
0.9.4
What to do
Update pub/sns.php in the W3 Total Cache to 0.9.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com vinhjaxt.github.io
Mar 24, 2019WordPress Social Warfare Plugin Cross-Site Scripting (XSS) VulnerabilityCVE-2019-9978 · WordPress plugins & themes · reported by MITREExploitedMedium 6.1
WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.
Product
Social Warfare Plugin
Fixed in
3.5.3
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 21, 2019A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allCVE-2019-7299 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the subject parameter in wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/ajax/submit_ticket.php.
Product
WP Support Plus Responsive Ticket System
Affected
9.1.1 to 9.1.1
What to do
Affects 9.1.1 to 9.1.1. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.kalasag.com.ph wordpress.org
Jan 12, 2019WordPress plugin spam-byebye 2.2.1 and earlier: Cross-site scriptingCVE-2018-16206 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WordPress plugin spam-byebye 2.2.1 and earlier
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WordPress plugin spam-byebye 2.2.1 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 9, 2019Google XML Sitemaps Version 4.0.9 and earlier: Cross-site scriptingCVE-2018-16204 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Google XML Sitemaps Version 4.0.9 and earlier
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Google XML Sitemaps Version 4.0.9 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 9, 2019LearnPress prior to version 3.1.0: Cross-site scriptingCVE-2018-16173 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
LearnPress prior to version 3.1.0
Fixed in
3.1.0
What to do
Update LearnPress prior to version 3.1.0 to 3.1.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 9, 2019Event Calendar WD version 1.1.21 and earlier: Cross-site scriptingCVE-2018-16164 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Event Calendar WD version 1.1.21 and earlier
Affected
up to 1.1.21
What to do
Affects up to 1.1.21. Update Event Calendar WD version 1.1.21 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Nov 15, 2018XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submisCVE-2018-19287 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.
Product
XSS in the Ninja Forms
Fixed in
3.3.18
What to do
Update XSS in the Ninja Forms to 3.3.18 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0CVE-2018-17866 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field.
Fixed in
2.0.28
What to do
Update the plugin to 2.0.28 or newer.
Full record and what to do →NVD record serhack.me wordpress.org
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Product
wp-slimstat (aka Slimstat Analytics)
Fixed in
4.1.6.1
What to do
Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Sep 7, 2018FV Flowplayer Video Player 6.1.2 to 6.6.4: Cross-site scriptingCVE-2018-0642 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
FV Flowplayer Video Player 6.1.2 to 6.6.4
Affected
6.1.2 to 6.6.4
What to do
Affects 6.1.2 to 6.6.4. Update FV Flowplayer Video Player 6.1.2 to 6.6.4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Aug 28, 2018Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2014-4932 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
Product
Cross-site scripting (XSS) vulnerability in the Wordfence Security
Fixed in
5.1.5
What to do
Update Cross-site scripting (XSS) vulnerability in the Wordfence Security to 5.1.5 or newer.
Full record and what to do →NVD record techdefencelabs.com wordfence.com
Jul 16, 2018Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attacCVE-2018-13832 · WordPress plugins & themes · reported by MITREMedium 4.8
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text.
Product
Techotronic all-in-one-favicon (aka All In One Favicon)
Fixed in
4.6
What to do
Update Techotronic all-in-one-favicon (aka All In One Favicon) to 4.6 or newer.
Full record and what to do →NVD record hackpuntes.com exploit-db.com
Jun 26, 2018WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker cCVE-2018-1000556 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacker must craft an URL with payload and send to the user. Victim need to open the link to be affected by reflected XSS. .
Fixed in
12.0.6
What to do
Update the plugin to 12.0.6 or newer.
Full record and what to do →NVD record pluginvulnerabilities.com pluginvulnerabilities.com
Jun 26, 2018Site Reviews versions prior to 2.15.3: Cross-site scriptingCVE-2018-0603 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Site Reviews versions prior to 2.15.3
Fixed in
2.15.3
What to do
Update Site Reviews versions prior to 2.15.3 to 2.15.3 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jun 26, 2018Email Subscribers & Newsletters versions prior to 3.5.0: Cross-site scriptingCVE-2018-0602 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Email Subscribers & Newsletters versions prior to 3.5.0
Fixed in
3.5.0
What to do
Update Email Subscribers & Newsletters versions prior to 3.5.0 to 3.5.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jun 4, 2018wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site ScriptinCVE-2018-11709 · WordPress plugins & themes · reported by MITREMedium 6.1
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI.
Product
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum
Fixed in
1.4.12
What to do
Update wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum to 1.4.12 or newer.
Full record and what to do →NVD record blog.dewhurstsecurity.com wordpress.org
May 22, 2018init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled.CVE-2018-11366 · WordPress plugins & themes · reported by MITREMedium 6.1
init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled. This is fixed in 1.4.0.
Product
init.php in the Loginizer plugin 1.3.8
Affected
up to 1.3.9
Fixed in
1.4.0
What to do
Update init.php in the Loginizer plugin 1.3.8 to 1.4.0 or newer.
Full record and what to do →NVD record blog.dewhurstsecurity.com plugins.trac.wordpress.org
May 15, 2018There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) CVE-2018-11105 · WordPress plugins & themes · reported by MITREMedium 6.1
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.
Product
There is stored cross site scripting in the wp-live-chat-support
Fixed in
8.0.08
What to do
Update There is stored cross site scripting in the wp-live-chat-support to 8.0.08 or newer.
Full record and what to do →NVD record github.com wordpress.org
May 14, 2018Ultimate Member plugin prior to version 2.0.4 for: Cross-site scriptingCVE-2018-0585 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Ultimate Member plugin prior to version 2.0.4 for
Fixed in
2.0.4
What to do
Update Ultimate Member plugin prior to version 2.0.4 for to 2.0.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 14, 2018Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for: Cross-site scriptingCVE-2018-0579 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for
Fixed in
2.2.4.1
What to do
Update Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for to 2.2.4.1 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 14, 2018PixelYourSite plugin prior to version 5.3.0 for: Cross-site scriptingCVE-2018-0578 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
PixelYourSite plugin prior to version 5.3.0 for
Fixed in
5.3.0
What to do
Update PixelYourSite plugin prior to version 5.3.0 for to 5.3.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 14, 2018WP Google Map Plugin prior to version 4.0.4 for: Cross-site scriptingCVE-2018-0577 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WP Google Map Plugin prior to version 4.0.4 for
Fixed in
4.0.4
What to do
Update WP Google Map Plugin prior to version 4.0.4 for to 4.0.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 14, 2018Events Manager plugin prior to version 5.9 for: Cross-site scriptingCVE-2018-0576 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Events Manager plugin prior to version 5.9 for
Fixed in
5.9
What to do
Update Events Manager plugin prior to version 5.9 for to 5.9 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 30, 2018Image Alt & Title Text: Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS)CVE-2018-1000172 · WordPress plugins & themes · reported by MITREMedium 4.8
Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45.
Product
Image Alt & Title Text
Affected
up to 2.2.30
Fixed in
2.2.45
What to do
Update Image Alt & Title Text to 2.2.45 or newer.
Full record and what to do →NVD record fortiguard.com wordpress.org
Apr 25, 2018A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress thCVE-2018-10310 · WordPress plugins & themes · reported by MITREMedium 5.4
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context of a victim's browser.
Fixed in
2.3.10
What to do
Update the plugin to 2.3.10 or newer.
Full record and what to do →NVD record packetstormsecurity.com gist.github.com
Apr 23, 2018the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for: Cross-site scripting (XSS)CVE-2018-10301 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post.
Product
the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for
Fixed in
1.3.1
What to do
Update the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for to 1.3.1 or newer.
Full record and what to do →NVD record medium.com wpvulndb.com
Apr 23, 2018Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2018-10300 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio.
Product
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD
Fixed in
1.3.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD to 1.3.1 or newer.
Full record and what to do →NVD record medium.com wpvulndb.com
Apr 23, 2018Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input fieldCVE-2018-10234 · WordPress plugins & themes · reported by MITREMedium 4.8
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account page.
Product
Authenticated Cross site Scripting exists in the User Profile & Membership
Fixed in
2.0.11
What to do
Update Authenticated Cross site Scripting exists in the User Profile & Membership to 2.0.11 or newer.
Full record and what to do →NVD record github.com wordpress.org
Apr 20, 2018Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web sCVE-2018-7747 · WordPress plugins & themes · reported by MITREMedium 4.8
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email transaction log, or (3) an imported form.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms
Fixed in
1.6.0-rc.1
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms to 1.6.0-rc.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com calderaforms.com
Apr 12, 2018Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5CVE-2015-4557 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413.
Fixed in
1.5.2
What to do
Update the plugin to 1.5.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Apr 4, 2018lib/interface.php of the Relevanssi plugin 4.0.4 for: Cross-site scripting (XSS)CVE-2018-9034 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the tab GET parameter.
Product
lib/interface.php of the Relevanssi plugin 4.0.4 for
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update lib/interface.php of the Relevanssi plugin 4.0.4 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Mar 29, 2018Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrCVE-2014-6604 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter.
Product
Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2
Fixed in
10.16
What to do
Update Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 to 10.16 or newer.
Full record and what to do →NVD record barmat.io plugins.trac.wordpress.org
Mar 26, 2018installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for: Cross-site scripting (XSS)CVE-2018-7543 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter.
Product
installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for
Affected
1.2.32 to 1.2.32
What to do
Affects 1.2.32 to 1.2.32. Update installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record snapcreek.com exploit-db.com
Mar 19, 2018Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject CVE-2014-2297 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.
Product
VideoWhisper Live Streaming Integration
Affected
4.29.6 to 4.29.6
What to do
Affects 4.29.6 to 4.29.6. Update VideoWhisper Live Streaming Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Mar 15, 2018Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript CVE-2018-8729 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log
Fixed in
2.4.1
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log to 2.4.1 or newer.
Full record and what to do →NVD record github.com github.com
Mar 9, 2018WP All Import plugin prior to version 3.4.7 for: Cross-site scriptingCVE-2018-0547 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP All Import plugin prior to version 3.4.7 for
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update WP All Import plugin prior to version 3.4.7 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Mar 9, 2018WP All Import plugin prior to version 3.4.6 for: Cross-site scriptingCVE-2018-0546 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP All Import plugin prior to version 3.4.6 for
Fixed in
3.4.6
What to do
Update WP All Import plugin prior to version 3.4.6 for to 3.4.6 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Feb 19, 2018Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit CVE-2015-2324 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery
Fixed in
1.2.13
What to do
Update Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery to 1.2.13 or newer.
Full record and what to do →NVD record fortiguard.com github.com
Feb 16, 2018core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitizeCVE-2018-6944 · WordPress plugins & themes · reported by MITREMedium 6.1
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
Product
UltimateMember
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update UltimateMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Feb 16, 2018core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitizCVE-2018-6943 · WordPress plugins & themes · reported by MITREMedium 6.1
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
Product
UltimateMember
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update UltimateMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Feb 8, 2018Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2015-2329 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.3.6
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.3.6 or newer.
Full record and what to do →NVD record fortiguard.com raw.githubusercontent.com
Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6469 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_tags parameter to wp-admin/options-general.php.
Product
flickrRSS
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6468 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_id parameter to wp-admin/options-general.php.
Product
flickrRSS
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.