Updated 1 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

12,551 results · page 242 of 252

Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6466 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_set parameter to wp-admin/options-general.php.
Product
flickrRSS
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 1, 2018WP Retina 2x prior to version 5.2.2: Cross-site scriptingCVE-2018-0511 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP Retina 2x prior to version 5.2.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP Retina 2x prior to version 5.2.2
Fixed in
5.2.2
What to do
Update WP Retina 2x prior to version 5.2.2 to 5.2.2 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jan 30, 2018A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 foCVE-2018-6194 · WordPress plugins & themes · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php.
Fixed in
2.1.1
What to do
Update the plugin to 2.1.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 22, 2018The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview CVE-2018-6002 · WordPress plugins & themes · reported by MITREMedium 6.1
The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter).
Affected
up to 3.9
What to do
Affects up to 3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 22, 2018The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview paraCVE-2018-6001 · WordPress plugins & themes · reported by MITREMedium 6.1
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter).
Affected
up to 4.6
What to do
Affects up to 4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Dec 27, 2017Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbCVE-2015-7668 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter.
Product
Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map
Fixed in
1.3.0
What to do
Update Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map to 1.3.0 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Dec 27, 2017Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin befoCVE-2015-7667 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter.
Fixed in
1.0.2
What to do
Update the plugin to 1.0.2 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Dec 27, 2017Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.CVE-2015-7666 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.
Fixed in
1.0.2
What to do
Update the plugin to 1.0.2 or newer.
Full record and what to do →NVD record securityfocus.com plugins.trac.wordpress.org
Dec 20, 2017Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitraCVE-2011-4955 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s or (2) p parameters to index.php.
Product
bSuite
Fixed in
5
What to do
Update bSuite to 5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Dec 19, 2017Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary webCVE-2017-17753 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cie_type, (2) cie_import, (3) cie_update, or (4) cie_ignore parameter to includes/admin/views/esb-cie-import-export-page.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export
Affected
up to 1.1
What to do
Affects up to 1.1. Update Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
Dec 19, 2017A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2017-17744 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter to view/advancedsettings.php.
Product
A cross-site scripting (XSS) vulnerability in the custom-map
Affected
up to 1.1
What to do
Affects up to 1.1. Update A cross-site scripting (XSS) vulnerability in the custom-map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wpvulndb.com
Dec 19, 2017A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2017-17719 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the result_message parameter to includes/concours_page.php.
Product
A cross-site scripting (XSS) vulnerability in the wp-concours
Affected
up to 1.1
What to do
Affects up to 1.1. Update A cross-site scripting (XSS) vulnerability in the wp-concours to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wpvulndb.com
Dec 6, 2017The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.CVE-2017-17451 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.
Product
WP Mailster
Fixed in
1.5.5
What to do
Update WP Mailster to 1.5.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Dec 3, 2017Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via craftCVE-2017-17096 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via crafted OpenGraph data.
Product
Cross-site scripting (XSS) vulnerability in the Content Cards
Fixed in
0.9.7
What to do
Update Cross-site scripting (XSS) vulnerability in the Content Cards to 0.9.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Nov 15, 2017Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attCVE-2017-16842 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.
Product
Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO
Fixed in
5.8.0
What to do
Update Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO to 5.8.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Nov 9, 2017Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows reCVE-2017-16758 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "access_token" parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed
Fixed in
1.3
What to do
Update Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed to 1.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Oct 24, 2017Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web CVE-2017-15867 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, (3) user_id, (4) username, (5) country_name, (6) browser, (7) operating_system, or (8) ip_address parameter to admin/partials/listing/listing.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Oct 24, 2017Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.CVE-2017-15863 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.
Product
Cross Site Scripting (XSS) exists in the wp-noexternallinks
Fixed in
3.5.19
What to do
Update Cross Site Scripting (XSS) exists in the wp-noexternallinks to 3.5.19 or newer.
Full record and what to do →NVD record lists.openwall.net wordpress.org
Oct 23, 2017Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbCVE-2015-5532 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro)
Fixed in
1.8.4.3
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) to 1.8.4.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com paidmembershipspro.com
Oct 16, 2017Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2014-8087 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/ph_save.php.
Product
Cross-site scripting (XSS) vulnerability in the post highlights
Fixed in
2.6.1
What to do
Update Cross-site scripting (XSS) vulnerability in the post highlights to 2.6.1 or newer.
Full record and what to do →NVD record g0blin.co.uk wordpress.org
Oct 16, 2017Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress.CVE-2017-15375 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules. Remote attackers are able to inject malicious script code to hijack admin session credentials via the backend, or to manipulate the backend on client-side performed requests. The attack vector is non-persistent and the request method to inject is GET. The attacker does not need a privileged user account to perform a successful exploitation.
Affected
4.5.1 to 4.5.1
What to do
Affects 4.5.1 to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Oct 6, 2017Best Gallery Albums Plugin before 3.0.70for: Cross-site scripting (XSS)CVE-2014-8758 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in the gallery_album_sorting page to wp-admin/admin.php.
Product
Best Gallery Albums Plugin before 3.0.70for
Fixed in
3.0.70for
What to do
Update Best Gallery Albums Plugin before 3.0.70for to 3.0.70for or newer.
Full record and what to do →NVD record g0blin.co.uk wpvulndb.com
Oct 6, 2017Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attacCVE-2014-8492 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) site_name, (2) message, or (3) site_url parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder
Fixed in
2.0.3
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder to 2.0.3 or newer.
Full record and what to do →NVD record g0blin.co.uk wpvulndb.com
Oct 6, 2017Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web scripCVE-2014-7240 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a master_response action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution
Fixed in
1.7
What to do
Update Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution to 1.7 or newer.
Full record and what to do →NVD record g0blin.co.uk wpvulndb.com
Oct 2, 2017Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web sCVE-2015-7357 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.
Product
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0
Fixed in
2.7.10
What to do
Update Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 to 2.7.10 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 27, 2017Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrCVE-2017-14622 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store
Fixed in
2.1.1
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store to 2.1.1 or newer.
Full record and what to do →NVD record securityfocus.com packetstormsecurity.com
Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.CVE-2017-14726 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.CVE-2017-14724 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 23, 2017Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.CVE-2017-14721 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 23, 2017Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.CVE-2017-14720 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 23, 2017Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.CVE-2017-14718 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 19, 2017Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or CVE-2015-3299 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order.
Product
Cross-site scripting (XSS) vulnerability in the Floating Social Bar
Fixed in
1.1.7
What to do
Update Cross-site scripting (XSS) vulnerability in the Floating Social Bar to 1.1.7 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Sep 11, 2017Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web scrCVE-2015-8354 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php.
Product
Ultimate Member
Fixed in
1.3.29
What to do
Update Ultimate Member to 1.3.29 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 11, 2017Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2015-8353 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the Role Scoper
Fixed in
1.3.67
What to do
Update Cross-site scripting (XSS) vulnerability in the Role Scoper to 1.3.67 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 11, 2017Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web scriCVE-2015-8350 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action
Fixed in
2.5.1
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action to 2.5.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 28, 2017BackupGuard prior to version 1.1.47: Cross-site scriptingCVE-2017-10837 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
BackupGuard prior to version 1.1.47
Affected
up to 1.1.46
What to do
Affects up to 1.1.46. Update BackupGuard prior to version 1.1.47 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Aug 23, 2017DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.CVE-2017-13138 · WordPress plugins & themes · reported by MITREMedium 6.1
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.
Product
DOM based Cross-site scripting (XSS) vulnerability in the Bridge
Fixed in
11.2
What to do
Update DOM based Cross-site scripting (XSS) vulnerability in the Bridge to 11.2 or newer.
Full record and what to do →NVD record bridge.qodeinteractive.com imgur.com
Aug 18, 2017Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.CVE-2015-5057 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.
Fixed in
1.10.9
What to do
Update the plugin to 1.10.9 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Aug 2, 2017Simple Custom CSS and JS prior to version 3.4: Cross-site scriptingCVE-2017-2285 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Simple Custom CSS and JS prior to version 3.4
What to do
Update Simple Custom CSS and JS prior to version 3.4 to the newest version.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Aug 2, 2017Popup Maker prior to version 1.6.5: Cross-site scriptingCVE-2017-2284 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Popup Maker prior to version 1.6.5
What to do
Update Popup Maker prior to version 1.6.5 to the newest version.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jul 17, 2017WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected siteCVE-2017-1000038 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site
Affected
3.5.7.1 to 3.5.7.1
What to do
Affects 3.5.7.1 to 3.5.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Jul 17, 2017Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in CVE-2017-1000033 · WordPress plugins & themes · reported by MITREMedium 6.1
Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user.
Affected
up to 1.3
What to do
Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cjc.im wpvulndb.com
Jul 7, 2017Responsive Lightbox prior to version 1.7.2: Cross-site scriptingCVE-2017-2243 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
Responsive Lightbox prior to version 1.7.2
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Responsive Lightbox prior to version 1.7.2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp securityfocus.com
Jul 7, 2017Event Calendar WD prior to version 1.0.94: Cross-site scriptingCVE-2017-2224 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Event Calendar WD prior to version 1.0.94
Affected
up to 1.0.93
What to do
Affects up to 1.0.93. Update Event Calendar WD prior to version 1.0.94 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com jvn.jp
Jul 7, 2017WP-Members prior to version 3.1.8: Cross-site scriptingCVE-2017-2222 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WP-Members prior to version 3.1.8
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update WP-Members prior to version 3.1.8 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jul 7, 2017WordPress Download Manager prior to version 2.9.50: Cross-site scriptingCVE-2017-2216 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WordPress Download Manager prior to version 2.9.50
Affected
up to 2.9.49
What to do
Affects up to 2.9.49. Update WordPress Download Manager prior to version 2.9.50 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jun 15, 2017Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScCVE-2017-9419 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter.
Product
Webhammer WP Custom Fields Search
Affected
0.3.28 to 0.3.28
What to do
Affects 0.3.28 to 0.3.28. Update Webhammer WP Custom Fields Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Jun 9, 2017WP Live Chat Support prior to version 7.0.07: Cross-site scriptingCVE-2017-2187 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WP Live Chat Support prior to version 7.0.07
Affected
up to 7.0.06
What to do
Affects up to 7.0.06. Update WP Live Chat Support prior to version 7.0.07 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jun 7, 2017Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.CVE-2014-9310 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.
Product
Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox
Fixed in
4.1
What to do
Update Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox to 4.1 or newer.
Full record and what to do →NVD record securityfocus.com security.szurek.pl
Jun 5, 2017Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via theCVE-2017-9420 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.
Product
Cross site scripting (XSS) vulnerability in the Spiffy Calendar
Fixed in
3.3.0
What to do
Update Cross site scripting (XSS) vulnerability in the Spiffy Calendar to 3.3.0 or newer.
Full record and what to do →NVD record spiffycalendar.sunnythemes.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.