Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

1,260 results · page 25 of 26

Aug 13, 2019The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.CVE-2015-9300 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Product
events-manager
Fixed in
5.5.7
What to do
Update events-manager to 5.5.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.CVE-2015-9299 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
Product
events-manager
Fixed in
5.5.7.1
What to do
Update events-manager to 5.5.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has code injection.CVE-2015-9298 · WordPress plugins & themes · reported by MITRECritical 9.8
The events-manager plugin before 5.6 for WordPress has code injection.
Product
events-manager
Fixed in
5.6
What to do
Update events-manager to 5.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has XSS.CVE-2015-9297 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.6 for WordPress has XSS.
Product
events-manager
Fixed in
5.6
What to do
Update events-manager to 5.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 21, 2019A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via theCVE-2019-14205 · WordPress plugins & themes · reported by MITREHigh 7.5
A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.
Product
A Local File Inclusion vulnerability in the Nevma Adaptive Images
Fixed in
0.6.67
What to do
Update A Local File Inclusion vulnerability in the Nevma Adaptive Images to 0.6.67 or newer.
Full record and what to do →NVD record github.com markgruffer.github.io
Jul 18, 2019A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9.CVE-2019-13575 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Jul 18, 2019The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.CVE-2016-10763 · WordPress plugins & themes · reported by MITREMedium 4.8
The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.
Product
CampTix Event Ticketing
Fixed in
1.5
What to do
Update CampTix Event Ticketing to 1.5 or newer.
Full record and what to do →NVD record hackerone.com wordpress.org
Jul 18, 2019The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.CVE-2016-10762 · WordPress plugins & themes · reported by MITREHigh 7.5
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.
Product
CampTix Event Ticketing
Fixed in
1.5
What to do
Update CampTix Event Ticketing to 1.5 or newer.
Full record and what to do →NVD record hackerone.com wordpress.org
Jun 10, 2019The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' iCVE-2019-9881 · WordPress plugins & themes · reported by MITREMedium 5.3
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
Affected
0.2.3 to 0.2.3
What to do
Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 10, 2019The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed.CVE-2019-9879 · WordPress plugins & themes · reported by MITRECritical 9.8
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.
Affected
0.2.3 to 0.2.3
What to do
Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
May 23, 2019In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/CVE-2019-10866 · WordPress plugins & themes · reported by MITRECritical 9.8
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
Product
In the Form Maker
Fixed in
1.13.3
What to do
Update In the Form Maker to 1.13.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
May 20, 2019The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.CVE-2019-12241 · WordPress plugins & themes · reported by MITRECritical 9.8
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.
Affected
1.4.5 to 1.4.5
What to do
Affects 1.4.5 to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record dumpco.re wpvulndb.com
May 13, 2019The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or CVE-2018-18872 · WordPress plugins & themes · reported by MITREMedium 5.4
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI.
Product
Kieran O'Shea Calendar
Fixed in
1.3.11
What to do
Update Kieran O'Shea Calendar to 1.3.11 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Apr 12, 2019The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-maCVE-2018-13137 · WordPress plugins & themes · reported by MITREMedium 4.8
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
Affected
5.9.4 to 5.9.4
What to do
Affects 5.9.4 to 5.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com gist.github.com
Jan 9, 2019Event Calendar WD version 1.1.21 and earlier: Cross-site scriptingCVE-2018-16164 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Event Calendar WD version 1.1.21 and earlier
Affected
up to 1.1.21
What to do
Affects up to 1.1.21. Update Event Calendar WD version 1.1.21 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jun 26, 2018WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passeCVE-2018-12895 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.
Affected
up to 4.9.6
What to do
Affects up to 4.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 14, 2018Events Manager plugin prior to version 5.9 for: Cross-site scriptingCVE-2018-0576 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Events Manager plugin prior to version 5.9 for
Fixed in
5.9
What to do
Update Events Manager plugin prior to version 5.9 for to 5.9 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 10, 2018The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveragiCVE-2014-1889 · WordPress plugins & themes · reported by MITREMedium 6.5
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.
Product
Group creation process in the Buddypress
Fixed in
1.9.2
What to do
Update Group creation process in the Buddypress to 1.9.2 or newer.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Mar 25, 2018The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.CVE-2018-9020 · WordPress plugins & themes · reported by MITREMedium 5.4
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.
Product
Events Manager
Fixed in
5.8.1.2
What to do
Update Events Manager to 5.8.1.2 or newer.
Full record and what to do →NVD record wp-events-plugin.com wordpress.org
Mar 19, 2018A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_pathCVE-2018-7422 · WordPress plugins & themes · reported by MITREHigh 7.5
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
Product
A Local File Inclusion vulnerability in the Site Editor
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update A Local File Inclusion vulnerability in the Site Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wpvulndb.com
Jan 12, 2018The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.CVE-2018-5315 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jan 5, 2018The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveragingCVE-2014-8336 · WordPress plugins & themes · reported by MITREMedium 6.5
The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.
Product
Sql Run Query" panel in WP-DBManager (aka Database Manager)
Fixed in
2.7.2
What to do
Update Sql Run Query" panel in WP-DBManager (aka Database Manager) to 2.7.2 or newer.
Full record and what to do →NVD record openwall.com vapid.dhs.org
Oct 19, 2017WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging accessCVE-2012-6707 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Sep 27, 2017SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recuCVE-2017-14760 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.
Product
event-espresso-free (aka Event Espresso Lite)
Affected
up to 3.1.37.12.l
What to do
Affects up to 3.1.37.12.l. Update event-espresso-free (aka Event Espresso Lite) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sstrunk.com sstrunk.com
Sep 14, 2017Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameterCVE-2017-1002026 · WordPress plugins & themes · reported by larry0@me.comHigh 8.8
Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.
Affected
3.1.37.11.l to 3.1.37.11.l
What to do
Affects 3.1.37.11.l to 3.1.37.11.l. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the eCVE-2017-1002019 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
Affected
1.02.2 to 1.02.2
What to do
Affects 1.02.2 to 1.02.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the evCVE-2017-1002018 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
Affected
1.02.2 to 1.02.2
What to do
Affects 1.02.2 to 1.02.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.CVE-2017-1002017 · WordPress plugins & themes · reported by larry0@me.comMedium 6.1
Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 7, 2017SQL injection vulnerability in WordPress Community Events plugin before 1.4.CVE-2015-3313 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in WordPress Community Events plugin before 1.4.
Fixed in
1.4
What to do
Update the plugin to 1.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Aug 7, 2017The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.CVE-2014-9260 · WordPress plugins & themes · reported by MITREHigh 8.8
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
Product
basic_settings function in the download manager
Fixed in
2.7.3
What to do
Update basic_settings function in the download manager to 2.7.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 1, 2017The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.CVE-2017-12068 · WordPress plugins & themes · reported by MITREMedium 6.1
The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.
Affected
0.7.9 to 0.7.9
What to do
Affects 0.7.9 to 0.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 26, 2017In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficientCVE-2017-11658 · WordPress plugins & themes · reported by MITREHigh 7.5
In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.
Product
WP Rocket
What to do
Update WP Rocket to the newest version.
Full record and what to do →NVD record gist.github.com wp-rocket.me
Jul 7, 2017Event Calendar WD prior to version 1.0.94: Cross-site scriptingCVE-2017-2224 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Event Calendar WD prior to version 1.0.94
Affected
up to 1.0.93
What to do
Affects up to 1.0.93. Update Event Calendar WD prior to version 1.0.94 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com jvn.jp
Jun 13, 2017SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to CVE-2017-9429 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php.
Product
Event List
Affected
0.7.8 to 0.7.8
What to do
Affects 0.7.8 to 0.7.8. Update Event List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Apr 12, 2017SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendarCVE-2017-7719 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.
Product
SQL injection in the Spider Event Calendar (aka spider-event-calendar)
Fixed in
1.5.52
What to do
Update SQL injection in the Spider Event Calendar (aka spider-event-calendar) to 1.5.52 or newer.
Full record and what to do →NVD record lists.openwall.net securityfocus.com
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.CVE-2016-5838 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/inCVE-2016-5835 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 25, 2016The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of tCVE-2016-4828 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account.
Product
Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Aug 18, 2015Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 forCVE-2015-5485 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php.
Fixed in
3.10.2
What to do
Update the plugin to 3.10.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 3, 2015Spider Event Calendar 1.4.9 for: SQL injectionCVE-2015-2196 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.
Product
Spider Event Calendar 1.4.9 for
Affected
1.4.9 to 1.4.9
What to do
Affects 1.4.9 to 1.4.9. Update Spider Event Calendar 1.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Nov 25, 2014wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveragiCVE-2014-9039 · WordPress plugins & themes · reported by MITREMedium 4.3
wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.
Fixed in
3.7.5
What to do
Update the plugin to 3.7.5 or newer.
Full record and what to do →NVD record advisories.mageia.org core.trac.wordpress.org
Nov 4, 2014SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the caliCVE-2014-8586 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter.
Product
CP Multi View Event Calendar
What to do
Update CP Multi View Event Calendar to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script CVE-2014-7138 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the Google Calendar Events
Fixed in
2.0.4
What to do
Update Cross-site scripting (XSS) vulnerability in the Google Calendar Events to 2.0.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 22, 2014Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication CVE-2014-3843 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Search Everything
Fixed in
8.1.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Search Everything to 8.1.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 13, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remCVE-2013-1407 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro
Fixed in
5.3.5
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro to 5.3.5 or newer.
Full record and what to do →NVD record archives.neohapsis.com wp-events-plugin.com
Apr 9, 2014WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includeCVE-2014-0165 · WordPress plugins & themes · reported by Red HatMedium 4
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Fixed in
3.7.2
What to do
Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD record codex.wordpress.org codex.wordpress.org
Mar 9, 2014SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL comCVE-2014-2316 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information.
Product
SQL injection vulnerability in se_search_default in the Search Everything
Fixed in
7.0.3
What to do
Update SQL injection vulnerability in se_search_default in the Search Everything to 7.0.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Sep 12, 2013The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users tCVE-2013-5739 · WordPress plugins & themes · reported by MITRELow 3.5
The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.
Fixed in
3.6.1
What to do
Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Sep 12, 2013wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and proviCVE-2013-4340 · WordPress plugins & themes · reported by Red HatLow 3.5
wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.
Fixed in
3.6.1
What to do
Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 2, 2013wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals thCVE-2013-0721 · WordPress plugins & themes · reported by MITREMedium 5
wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
Product
WP PHP widget
What to do
Update WP PHP widget to the newest version.
Full record and what to do →NVD record osvdb.org osvdb.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.