Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

495new WordPress flaws this week

394,829entries in the database

12,551 results · page 244 of 252

Jul 24, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HCVE-2015-2973 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart
Fixed in
1.4.18
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Welcart to 1.4.18 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jul 16, 2015Cross-site scripting (XSS) vulnerability in the save_order function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPresCVE-2015-5528 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the save_order function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the items[] parameter in an fsb_save_order action to wp-admin/admin-ajax.php.
Fixed in
1.1.6
What to do
Update the plugin to 1.1.6 or newer.
Full record and what to do →NVD record packetstormsecurity.com security.szurek.pl
Jun 30, 2015Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script CVE-2015-5151 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.
Product
Slider Revolution (revslider)
Affected
4.2.2 to 4.2.2
What to do
Affects 4.2.2 to 4.2.2. Update Slider Revolution (revslider) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 24, 2015Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for CVE-2015-4413 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.
Fixed in
1.5.6
What to do
Update the plugin to 1.5.6 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 18, 2015Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary webCVE-2015-4139 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php.
Product
WP Smiley
Affected
1.4.1 to 1.4.1
What to do
Affects 1.4.1 to 1.4.1. Update WP Smiley to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Jun 17, 2015Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via CVE-2015-4337 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual parameter in the xcloner_show page to wpadmin/plugins.php.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2015example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2,: Cross-site scripting (XSS)CVE-2015-3429 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
Product
example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2,
Fixed in
3.3.1
What to do
Update example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, to 3.3.1 or newer.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Jun 17, 2015Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to injectCVE-2012-6692 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
Product
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast
Fixed in
2.2
What to do
Update Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast to 2.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 10, 2015Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web scripCVE-2015-4465 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register
Fixed in
1.1.0
What to do
Update Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
May 29, 2015Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress allow remote attackers to inject arbitraryCVE-2015-3904 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) pin, (2) start_day, (3) start_month, (4) start_year, (5) end_day, (6) end_month, (7) end_year, (8) lang, (9) adults, or (10) children parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud
Fixed in
1.3
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud to 1.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
May 28, 2015Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to CVE-2015-4133 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
Product
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery
Fixed in
3.1.4
What to do
Update Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery to 3.1.4 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
May 28, 2015Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2015-4127 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.
Product
Cross-site scripting (XSS) vulnerability in the church_admin
Fixed in
0.810
What to do
Update Cross-site scripting (XSS) vulnerability in the church_admin to 0.810 or newer.
Full record and what to do →NVD record packetstormsecurity.com osvdb.org
May 28, 2015Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the valCVE-2015-4084 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value_ parameter in a check_stat action to wp-admin/admin-ajax.php.
Product
Free Counter
Affected
1.1 to 1.1
What to do
Affects 1.1 to 1.1. Update Free Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 27, 2015Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenCVE-2015-4065 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php.
Product
Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages
Fixed in
1.8.5
What to do
Update Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages to 1.8.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 27, 2015Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to iCVE-2015-4063 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress
Fixed in
0.9.9
What to do
Update Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress to 0.9.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 21, 2015Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote CVE-2015-3647 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) comemail or (2) comname parameter in a wppa do-comment action.
Product
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA)
Fixed in
6.1.3
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) to 6.1.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 14, 2015Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WorCVE-2015-3300 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2) billing_lastname, (3) billing_company, (4) billing_tax_id_number, (5) billing_city, (6) billing_street, (7) billing_street_2, (8) billing_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shipping_lastname, (14) shipping_company, (15) shipping_tax_id_number, (16) shipping_city, (17) shipping_street, (18) shipping_street_2, (19) shipping_postcode, (20) shipping_telephone_1, (21) shipping_telephone_2, or (22) shipping_fax parameter to shopping-cart/checkout/; the (23) search_by parameter in the admin/AddressesList.php page to wp-admin/admin.php; the (24) address_id, (25) address_name, (26) firstname, (27) lastname, (28) street, (29) city, (30) postcode, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type parameter in the admin/AssignedCategoriesList.php page to wp-admin/admin.php; or the (3
Fixed in
1.3.9.3
What to do
Update the plugin to 1.3.9.3 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Apr 14, 2015Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitraCVE-2014-9311 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the location[id] parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic
Fixed in
7.6.1.0
What to do
Update Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic to 7.6.1.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com security.szurek.pl
Apr 3, 2015The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta DescriptCVE-2015-0902 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.
Product
Semper Fi All in One SEO Pack
Fixed in
2.2.6
What to do
Update Semper Fi All in One SEO Pack to 2.2.6 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 31, 2015Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2015-0901 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
duwasai flashy
Affected
up to 1.3
What to do
Affects up to 1.3. Update duwasai flashy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 17, 2015Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the taCVE-2015-2315 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminder_popup action to the default URI.
Product
Cross-site scripting (XSS) vulnerability in the WPML
Fixed in
3.1.9
What to do
Update Cross-site scripting (XSS) vulnerability in the WPML to 3.1.9 or newer.
Full record and what to do →NVD record klikki.fi packetstormsecurity.com
Mar 5, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web scriCVE-2015-2220 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms
Fixed in
2.8.9
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms to 2.8.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Mar 5, 2015Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.CVE-2015-2218 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
Fixed in
2.1
What to do
Update the plugin to 2.1 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Mar 3, 2015Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or CVE-2015-2195 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) paged, or (3) s parameter in the wp-media-cleaner page to wp-admin/upload.php.
Product
WP Media Cleaner
Affected
2.2.6 to 2.2.6
What to do
Affects 2.2.6 to 2.2.6. Update WP Media Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Feb 24, 2015Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2015-2069 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.2.11
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.2.11 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Feb 20, 2015Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote atCVE-2015-2040 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php.
Product
Contact Form DB (aka CFDB and contact-form-7-to-database-extension)
Affected
2.8.26 to 2.8.26
What to do
Affects 2.8.26 to 2.8.26. Update Contact Form DB (aka CFDB and contact-form-7-to-database-extension) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Feb 19, 2015Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script orCVE-2015-1879 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.
Product
Cross-site scripting (XSS) vulnerability in the Google Doc Embedder
Fixed in
2.5.19
What to do
Update Cross-site scripting (XSS) vulnerability in the Google Doc Embedder to 2.5.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Feb 16, 2015Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2015-1436 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the (1) easingslider_manage_customizations or (2) easingslider_edit_sliders page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the Easing Slider
Fixed in
2.2.0.7
What to do
Update Cross-site scripting (XSS) vulnerability in the Easing Slider to 2.2.0.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Feb 11, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary webCVE-2015-1582 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or HTML via the (2) asc_or_desc, (3) order_by, (4) page_number, (5) serch_or_not, or (6) search_events_by_title parameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or (c) selectpostsforfacebook action to wp-admin/admin-ajax.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook
Fixed in
1.0.11
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook to 1.0.11 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Feb 3, 2015Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script orCVE-2015-1384 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the banner_effect_divid parameter in the BannerEffectOptions page to wp-admin/options-general.php.
Product
Cross-site scripting (XSS) vulnerability in the Banner Effect Header
Fixed in
1.2.8
What to do
Update Cross-site scripting (XSS) vulnerability in the Banner Effect Header to 1.2.8 or newer.
Full record and what to do →NVD record seclists.org securityfocus.com
Feb 2, 2015Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web CVE-2015-1385 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting
Fixed in
6.0.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting to 6.0.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Feb 2, 2015Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrarCVE-2015-1383 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search key.
Product
Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup
Fixed in
1.8.3
What to do
Update Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup to 1.8.3 or newer.
Full record and what to do →NVD record seclists.org openwall.com
Jan 27, 2015Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitraryCVE-2015-1366 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter.
Product
Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images
Fixed in
2.4
What to do
Update Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images to 2.4 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 21, 2015Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to injecCVE-2015-1204 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the wp-slim-view-2 page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat
Fixed in
3.9.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat to 3.9.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jan 15, 2015Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to injCVE-2014-9570 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) datefilter parameter in the access_log page to wp-admin/users.php or (2) simple_security_ip_blacklist[] parameter in an add_blacklist_ip action in the ip_blacklist page to wp-admin/users.php.
Product
MyWebsiteAdvisor Simple Security
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update MyWebsiteAdvisor Simple Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com htbridge.com
Jan 15, 2015inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart: Unrestricted file uploadCVE-2014-9308 · WordPress plugins & themes · reported by MITREMedium 6.5
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in products/banners/.
Product
inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart
Fixed in
3.0.9
What to do
Update inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart to 3.0.9 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 15, 2015Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id pCVE-2014-7956 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the Pods
Fixed in
2.5
What to do
Update Cross-site scripting (XSS) vulnerability in the Pods to 2.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 13, 2015Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2014-100027 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Product
Cross-site scripting (XSS) vulnerability in the WP SlimStat
Fixed in
3.5.6
What to do
Update Cross-site scripting (XSS) vulnerability in the WP SlimStat to 3.5.6 or newer.
Full record and what to do →NVD record secunia.com securityfocus.com
Jan 13, 2015Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject aCVE-2014-100026 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack
Fixed in
1.4.8
What to do
Update Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack to 1.4.8 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Jan 13, 2015Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to inject arbitrary webCVE-2014-100023 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the quiz parameter to wp-admin/edit.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz
Fixed in
3.0.7
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz to 3.0.7 or newer.
Full record and what to do →NVD record secunia.com exchange.xforce.ibmcloud.com
Jan 13, 2015Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2014-100018 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php.
Product
Cross-site scripting (XSS) vulnerability in the Unconfirmed
Fixed in
1.2.5
What to do
Update Cross-site scripting (XSS) vulnerability in the Unconfirmed to 1.2.5 or newer.
Full record and what to do →NVD record secunia.com securityfocus.com
Jan 13, 2015photocrati-gallery/ecomm-sizes.php in the Photocrati theme for: Cross-site scripting (XSS)CVE-2014-100016 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the prod_id parameter.
Product
photocrati-gallery/ecomm-sizes.php in the Photocrati theme for
What to do
Update photocrati-gallery/ecomm-sizes.php in the Photocrati theme for to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 13, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script CVE-2014-10016 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) unspecified vectors related to purchase_limit or the (2) name, (3) intl, (4) nocod, or (5) time parameter in an add_delivery_method action to wp-admin/admin-ajax.php.
Product
Welcart e-Commerce
Affected
1.3.12 to 1.3.12
What to do
Affects 1.3.12 to 1.3.12. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Jan 13, 2015the Another WordPress Classifieds Plugin plugin for: Cross-site scripting (XSS)CVE-2014-10012 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI.
Product
the Another WordPress Classifieds Plugin plugin for
Affected
3.3.1 to 3.3.1
What to do
Affects 3.3.1 to 3.3.1. Update the Another WordPress Classifieds Plugin plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Jan 13, 2015Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earCVE-2014-100008 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.
Product
Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel)
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com websecurity.com.ua
Jan 13, 2015Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject arbitrary web script oCVE-2014-100007 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the HK Exif Tags
Fixed in
1.12
What to do
Update Cross-site scripting (XSS) vulnerability in the HK Exif Tags to 1.12 or newer.
Full record and what to do →NVD record secunia.com exchange.xforce.ibmcloud.com
Jan 9, 2015Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 for WoCVE-2013-7419 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the roomid parameter.
Product
Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel)
Affected
2.2.1 to 2.2.1
What to do
Affects 2.2.1 to 2.2.1. Update Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jan 2, 2015Multiple cross-site scripting (XSS) vulnerabilities in simple-visitor-stat.php in the Simple visitor stat plugin for WordPress allow remote attackers to inject CVE-2014-9453 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in simple-visitor-stat.php in the Simple visitor stat plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP User-Agent or (2) HTTP Referer header.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Jan 2, 2015Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2014-9444 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errors[fu-disallowed-mime-type][0][name] parameter to the default URI.
Product
Frontend Uploader
Affected
0.9.2 to 0.9.2
What to do
Affects 0.9.2 to 0.9.2. Update Frontend Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 2, 2015Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2014-9443 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Relevanssi
Fixed in
3.3.8
What to do
Update Cross-site scripting (XSS) vulnerability in the Relevanssi to 3.3.8 or newer.
Full record and what to do →NVD record secunia.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.