Updated 45 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

495new WordPress flaws this week

394,829entries in the database

12,551 results · page 243 of 252

May 22, 2017MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19: Cross-site scriptingCVE-2017-2169 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19
What to do
Update MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 to the newest version.
Full record and what to do →NVD record jvndb.jvn.jp jvn.jp
May 22, 2017WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7: Cross-site scriptingCVE-2017-2168 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7
What to do
Update WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 to the newest version.
Full record and what to do →NVD record jvndb.jvn.jp jvn.jp
May 18, 2017In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.CVE-2017-9063 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 18, 2017In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not propCVE-2017-9061 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 17, 2017Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers toCVE-2015-3998 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
Product
adsense-click-fraud-monitoring
Affected
1.7.5 to 1.7.5
What to do
Affects 1.7.5 to 1.7.5. Update adsense-click-fraud-monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Mar 16, 2017Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remotCVE-2016-0770 · WordPress plugins & themes · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable.
Product
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory
Fixed in
8.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory to 8.5.9 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 11, 2017In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.CVE-2017-6818 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 11, 2017In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.CVE-2017-6817 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 11, 2017In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata.CVE-2017-6814 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record openwall.com debian.org
Jan 29, 2017wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2: Cross-site scripting (XSS)CVE-2017-5612 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.
Product
wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2
Fixed in
4.7.2
What to do
Update wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 to 4.7.2 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 23, 2017Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web CVE-2016-0765 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter.
Product
eShop
Affected
6.3.14 to 6.3.14
What to do
Affects 6.3.14 to 6.3.14. Update eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 14, 2017the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1: Cross-site scripting (XSS)CVE-2017-5490 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.
Product
the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1
Fixed in
4.7.1
What to do
Update the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 14, 2017Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script CVE-2017-5488 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 4, 2017Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackeCVE-2016-7168 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 3, 2017Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary webCVE-2016-10112 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted tax-rate table values in CSV format.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.6.9
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.6.9 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Aug 7, 2016the network settings page in WordPress before 4.5: Cross-site scripting (XSS)CVE-2016-6634 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
the network settings page in WordPress before 4.5
Fixed in
4.5
What to do
Update the network settings page in WordPress before 4.5 to 4.5 or newer.
Full record and what to do →NVD record codex.wordpress.org debian.org
Aug 2, 2016Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2016-4833 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Nofollow Links
Fixed in
1.0.11
What to do
Update Cross-site scripting (XSS) vulnerability in the Nofollow Links to 1.0.11 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 29, 2016the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3: Cross-site scripting (XSS)CVE-2016-5834 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
Product
the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3
Fixed in
4.5.3
What to do
Update the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3: Cross-site scripting (XSS)CVE-2016-5833 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
Product
the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3
Fixed in
4.5.3
What to do
Update the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 to 4.5.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jun 25, 2016Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web scriCVE-2016-4827 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826.
Product
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 25, 2016Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web scriCVE-2016-4826 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4827.
Product
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 4, 2016Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web scriCVE-2016-4812 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved
Fixed in
2.5.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved to 2.5.1 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
May 21, 2016flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2,: Cross-site scripting (XSS)CVE-2016-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Product
flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2,
Fixed in
2.21.0
What to do
Update flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, to 2.21.0 or newer.
Full record and what to do →NVD record openwall.com securitytracker.com
May 21, 2016plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2,: Cross-site scripting (XSS)CVE-2016-4566 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.
Product
plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2,
Fixed in
2.1.9
What to do
Update plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, to 2.1.9 or newer.
Full record and what to do →NVD record openwall.com plupload.com
May 21, 2016Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web sCVE-2016-1564 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.
Fixed in
4.4.1
What to do
Update the plugin to 4.4.1 or newer.
Full record and what to do →NVD record twitter.com debian.org
May 21, 2016wp-includes/wp-db.php in WordPress before 4.2.2: Cross-site scripting (XSS)CVE-2015-8834 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.
Product
wp-includes/wp-db.php in WordPress before 4.2.2
Fixed in
4.2.2
What to do
Update wp-includes/wp-db.php in WordPress before 4.2.2 to 4.2.2 or newer.
Full record and what to do →NVD record debian.org codex.wordpress.org
May 21, 2016the user list table in WordPress before 4.3.1: Cross-site scripting (XSS)CVE-2015-7989 · WordPress plugins & themes · reported by security@debian.orgMedium 5.4
Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.
Product
the user list table in WordPress before 4.3.1
Fixed in
4.3.1
What to do
Update the user list table in WordPress before 4.3.1 to 4.3.1 or newer.
Full record and what to do →NVD record debian.org debian.org
May 21, 2016WordPress before 4.3.1: Cross-site scripting (XSS)CVE-2015-5714 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
Product
WordPress before 4.3.1
Fixed in
4.3.1
What to do
Update WordPress before 4.3.1 to 4.3.1 or newer.
Full record and what to do →NVD record debian.org debian.org
Mar 25, 2016Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTCVE-2016-1160 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the WP Favorite Posts
Fixed in
1.6.6
What to do
Update Cross-site scripting (XSS) vulnerability in the WP Favorite Posts to 1.6.6 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jan 8, 2016Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTCVE-2014-7151 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the form_fields parameter in a (1) do_edit or (2) do_insert action to wp-admin/admin-ajax.php.
Product
NEX-Forms Lite
Affected
2.1.0 to 2.1.0
What to do
Affects 2.1.0 to 2.1.0. Update NEX-Forms Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.g0blin.co.uk wpvulndb.com
Jan 8, 2016Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject arbitrary web scriptCVE-2014-6444 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) t parameter to iframe-googlefont-preview.php or the (2) text parameter to iframe-font-preview.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework
Fixed in
1.6
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework to 1.6 or newer.
Full record and what to do →NVD record research.g0blin.co.uk wpvulndb.com
Nov 9, 2015the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5734 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.
Product
the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5733 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title.
Product
the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Nov 9, 2015the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5732 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.
Product
the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Oct 16, 2015Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to injeCVE-2015-7377 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
Product
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register
Fixed in
2.0.19
What to do
Update Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register to 2.0.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 29, 2015Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.CVE-2015-7320 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Fixed in
1.1.8
What to do
Update the plugin to 1.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 28, 2015Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remoteCVE-2015-7386 · WordPress plugins & themes · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.
Product
Gallery - Photo Albums - Portfolio
Affected
1.3.47 to 1.3.47
What to do
Affects 1.3.47 to 1.3.47. Update Gallery - Photo Albums - Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 21, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary weCVE-2015-6238 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) ga_adsense, (2) ga_admin_disable_DimentionIndex, (3) ga_downloads_prefix, (4) ga_downloads, or (5) ga_outbound_prefix parameter in the google-analyticator page to wp-admin/admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator
Fixed in
6.4.9.6
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator to 6.4.9.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 11, 2015Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script CVE-2015-6920 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Product
sourceAFRICA
Affected
0.1.3 to 0.1.3
What to do
Affects 0.1.3 to 0.1.3. Update sourceAFRICA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 2, 2015Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script CVE-2015-6805 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message.
Product
MDC Private Message
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update MDC Private Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Sep 1, 2015Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitraCVE-2015-2807 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Product
Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud
Fixed in
0.1.1
What to do
Update Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud to 0.1.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 31, 2015Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators toCVE-2015-6535 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
Product
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed
Fixed in
3.3.3
What to do
Update Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 18, 2015Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbCVE-2015-5481 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Product
Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments
Fixed in
2.3
What to do
Update Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 18, 2015Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 forCVE-2015-5485 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php.
Fixed in
3.10.2
What to do
Update the plugin to 3.10.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 13, 2015Cross-site scripting (XSS) vulnerability in the qTranslate plugin 2.5.39 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2015-5535 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the qTranslate plugin 2.5.39 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the qtranslate page to wp-admin/options-general.php.
Product
qTranslate
Affected
up to 2.5.39
What to do
Affects up to 2.5.39. Update qTranslate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 13, 2015Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTCVE-2015-2321 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field.
Product
Job Manager
Affected
up to 0.7.22
What to do
Affects up to 0.7.22. Update Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Aug 5, 2015the Ephox: Cross-site scripting (XSS)CVE-2015-3439 · WordPress plugins & themes · reported by security@debian.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.
Product
the Ephox
Fixed in
4.1.2
What to do
Update the Ephox to 4.1.2 or newer.
Full record and what to do →NVD record codex.wordpress.org lists.fedoraproject.org
Aug 4, 2015Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrarCVE-2015-3438 · WordPress plugins & themes · reported by security@debian.orgMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.
Fixed in
4.1.2
What to do
Update the plugin to 4.1.2 or newer.
Full record and what to do →NVD record codex.wordpress.org lists.fedoraproject.org
Aug 3, 2015WordPress before 4.2.3: Cross-site scripting (XSS)CVE-2015-5622 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.
Product
WordPress before 4.2.3
Fixed in
4.2.3
What to do
Update WordPress before 4.2.3 to 4.2.3 or newer.
Full record and what to do →NVD record codex.wordpress.org openwall.com
Aug 3, 2015wp-includes/wp-db.php in WordPress before 4.2.1: Cross-site scripting (XSS)CVE-2015-3440 · WordPress plugins & themes · reported by security@debian.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
Product
wp-includes/wp-db.php in WordPress before 4.2.1
Fixed in
4.2.1
What to do
Update wp-includes/wp-db.php in WordPress before 4.2.1 to 4.2.1 or newer.
Full record and what to do →NVD record codex.wordpress.org lists.fedoraproject.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.