Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
36added in the last 30 days
584new WordPress flaws this week
391,288entries in the database

1,208 results · page 25 of 25

  • Sep 30, 2013frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for: Unrestricted file uploadCVE-2013-5962 · WordPress plugins & themes · reported by MITREMedium 5.1

    Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.

    Product
    frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for
    Fixed in
    3.3.4
    What to do
    Update frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for to 3.3.4 or newer.

    Full record and what to do →NVD recordarchives.neohapsis.comcodecanyon.net

  • Jul 19, 2013Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and otCVE-2012-3414 · WordPress plugins & themes · reported by Red HatMedium 4.3

    Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.

    Affected
    up to 2.2.0.1
    Fixed in
    3.3.2
    What to do
    Update the plugin to 3.3.2 or newer.

    Full record and what to do →NVD recordbot24.blogspot.cacode.google.com

  • Apr 19, 2013Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication CVE-2013-2697 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8

    Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

    Product
    Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager
    Fixed in
    1.61
    What to do
    Update Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager to 1.61 or newer.

    Full record and what to do →NVD recordsecunia.comwordpress.org

  • May 21, 2012Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML CVE-2012-2912 · WordPress plugins & themes · reported by MITREMedium 4.3

    Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php.

    Product
    LeagueManager
    What to do
    Update LeagueManager to the newest version.

    Full record and what to do →NVD recordpacketstormsecurity.orgsecurityfocus.com

  • Apr 21, 2012Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earCVE-2012-2399 · WordPress plugins & themes · reported by MITREHigh 10

    Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

    Affected
    up to 2.2.0.1
    Fixed in
    3.5.2
    What to do
    Update the plugin to 3.5.2 or newer.

    Full record and what to do →NVD recordcore.trac.wordpress.orgjvn.jp

  • Jul 30, 2008upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for: Unrestricted file uploadCVE-2008-3362 · WordPress plugins & themes · reported by MITREHigh 10

    Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in wp-content/plugins/downloads-manager/upload/.

    Product
    upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for
    What to do
    Update upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for to the newest version.

    Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com

  • Jan 10, 2008ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for: Unrestricted file uploadCVE-2008-0222 · WordPress plugins & themes · reported by MITREHigh 7.5

    Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.

    Product
    ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for
    What to do
    Update ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com

  • Nov 26, 2005phpWordPress PHP News and Article Manager 3.0: SQL injectionCVE-2005-3844 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in phpWordPress PHP News and Article Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the (1) poll and (2) category parameters to index.php, and (3) the ctg parameter in an archive action.

    Product
    phpWordPress PHP News and Article Manager 3.0
    What to do
    Update phpWordPress PHP News and Article Manager 3.0 to the newest version.

    Full record and what to do →NVD recordforum.word-press.netpridels0.blogspot.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.