Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

494new WordPress flaws this week

394,829entries in the database

12,551 results · page 250 of 252

Apr 21, 2012Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earCVE-2012-2399 · WordPress plugins & themes · reported by MITREHigh 10
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.
Affected
up to 2.2.0.1
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org jvn.jp
Mar 19, 2012Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-5082 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
Product
s2Member Pro
Fixed in
111220
What to do
Update s2Member Pro to 111220 or newer.
Full record and what to do →NVD record secunia.com primothemes.com
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers CVE-2012-1068 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
Product
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments
Fixed in
2.0.7
What to do
Update Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments to 2.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jan 30, 2012Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attacCVE-2012-0782 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 20, 2012yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for: Cross-site scripting (XSS)CVE-2012-0901 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.
Product
yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for
What to do
Update yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.org exchange.xforce.ibmcloud.com
Jan 20, 2012Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-0895 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter.
Product
Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module
Fixed in
3.1.1
What to do
Update Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module to 3.1.1 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Jan 5, 2012wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used,: Cross-site scripting (XSS)CVE-2012-0287 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.
Product
wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used,
Fixed in
3.3.1
What to do
Update wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, to 3.3.1 or newer.
Full record and what to do →NVD record oldmanlab.blogspot.com securityfocus.com
Dec 27, 2011Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers toCVE-2011-3841 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.
Product
Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium
Fixed in
11.12.08
What to do
Update Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium to 11.12.08 or newer.
Full record and what to do →NVD record secunia.com secunia.com
Nov 29, 2011Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrCVE-2011-4568 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.
Product
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer
Fixed in
1.2.12
What to do
Update Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer to 1.2.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Nov 28, 2011Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WCVE-2011-4562 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.
Product
Redirection
What to do
Update Redirection to the newest version.
Full record and what to do →NVD record dotxed.net osvdb.org
Oct 7, 2011Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote CVE-2010-4875 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.
Product
Vodpod Video Gallery
What to do
Update Vodpod Video Gallery to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-3865 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Product
Cross-site scripting (XSS) vulnerability in the Black-LetterHead
Fixed in
1.6
What to do
Update Cross-site scripting (XSS) vulnerability in the Black-LetterHead to 1.6 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2011-3864 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Product
Cross-site scripting (XSS) vulnerability in the The Erudite
Fixed in
2.7.9
What to do
Update Cross-site scripting (XSS) vulnerability in the The Erudite to 2.7.9 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sCVE-2011-3863 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the RedLine
Fixed in
1.66
What to do
Update Cross-site scripting (XSS) vulnerability in the RedLine to 1.66 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2011-3862 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Product
Cross-site scripting (XSS) vulnerability in the Morning Coffee
Fixed in
3.6
What to do
Update Cross-site scripting (XSS) vulnerability in the Morning Coffee to 3.6 or newer.
Full record and what to do →NVD record secunia.com sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2011-3861 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Product
Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901
Fixed in
1.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 to 1.2 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via theCVE-2011-3860 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Cover WP
Fixed in
1.6.6
What to do
Update Cross-site scripting (XSS) vulnerability in the Cover WP to 1.6.6 or newer.
Full record and what to do →NVD record securityfocus.com sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cCVE-2011-3859 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Product
Cross-site scripting (XSS) vulnerability in the Trending
Fixed in
0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Trending to 0.2 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2011-3858 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Pixiv Custom
Fixed in
2.1.6
What to do
Update Cross-site scripting (XSS) vulnerability in the Pixiv Custom to 2.1.6 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via theCVE-2011-3857 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Antisnews
Fixed in
1.10
What to do
Update Cross-site scripting (XSS) vulnerability in the Antisnews to 1.10 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-3856 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Elegant Grunge
Fixed in
1.0.4
What to do
Update Cross-site scripting (XSS) vulnerability in the Elegant Grunge to 1.0.4 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CVE-2011-3855 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the F8 Lite
Fixed in
4.2.2
What to do
Update Cross-site scripting (XSS) vulnerability in the F8 Lite to 4.2.2 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s CVE-2011-3854 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the ZenLite
Fixed in
4.4
What to do
Update Cross-site scripting (XSS) vulnerability in the ZenLite to 4.4 or newer.
Full record and what to do →NVD record secunia.com sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpCVE-2011-3853 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Product
Cross-site scripting (XSS) vulnerability in the Hybrid
Fixed in
0.10
What to do
Update Cross-site scripting (XSS) vulnerability in the Hybrid to 0.10 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sCVE-2011-3852 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the EvoLve
Fixed in
1.2.6
What to do
Update Cross-site scripting (XSS) vulnerability in the EvoLve to 1.2.6 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpageCVE-2011-3851 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Product
Cross-site scripting (XSS) vulnerability in the News
Fixed in
0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the News to 0.2 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via thCVE-2011-3850 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in the Atahualpa
Fixed in
3.6.8
What to do
Update Cross-site scripting (XSS) vulnerability in the Atahualpa to 3.6.8 or newer.
Full record and what to do →NVD record secunia.com sitewat.ch
Aug 24, 2011magpie_debug.php in the Twitter Feed: Cross-site scripting (XSS)CVE-2010-4825 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in magpie_debug.php in the Twitter Feed plugin (wp-twitter-feed) 0.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Product
magpie_debug.php in the Twitter Feed
What to do
Update magpie_debug.php in the Twitter Feed to the newest version.
Full record and what to do →NVD record secunia.com johnleitch.net
Apr 7, 2011lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for: Cross-site scripting (XSS)CVE-2010-4779 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wptouch_settings parameter to include/adsense-new.php. NOTE: some of these details are obtained from third party information.
Product
lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for
What to do
Update lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Mar 14, 2011Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectorCVE-2011-0700 · WordPress plugins & themes · reported by Red HatLow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box.
Fixed in
3.0.5
What to do
Update the plugin to 3.0.5 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Mar 1, 2011Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers tCVE-2010-4747 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.
Product
Processing Embed
What to do
Update Processing Embed to the newest version.
Full record and what to do →NVD record secunia.com johnleitch.net
Feb 1, 2011magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for: Cross-site scripting (XSS)CVE-2011-0740 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.
Product
magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for
What to do
Update magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Jan 25, 2011Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitraCVE-2011-0641 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
StatPressCN
What to do
Update StatPressCN to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Jan 3, 2011Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML viCVE-2010-4536 · WordPress plugins & themes · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.
Fixed in
3.0.4
What to do
Update the plugin to 3.0.4 or newer.
Full record and what to do →NVD record core.trac.wordpress.org lists.fedoraproject.org
Dec 30, 2010Cross-site scripting (XSS) vulnerability in feedlist/handler_image.php in the FeedList plugin 2.61.01 for WordPress allows remote attackers to inject arbitrary CVE-2010-4637 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in feedlist/handler_image.php in the FeedList plugin 2.61.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
Product
FeedList
What to do
Update FeedList to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Dec 30, 2010Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to CVE-2010-4630 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Product
WP Survey And Quiz Tool
What to do
Update WP Survey And Quiz Tool to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Dec 22, 2010Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2010-4277 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php.
Product
Embedded Video
What to do
Update Embedded Video to the newest version.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 9, 2010Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject aCVE-2010-4518 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter.
Product
Safe Search
What to do
Update Safe Search to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 6, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to injectCVE-2010-4402 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.
Product
Register Plus
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Register Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Nov 3, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject aCVE-2010-3977 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com conviso.com.br
Apr 7, 2010Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitraCVE-2010-1186 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
Product
Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery
Fixed in
1.5.2
What to do
Update Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery to 1.5.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Dec 2, 2009Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web sCVE-2009-4169 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in
Fixed in
1.22
What to do
Update Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in to 1.22 or newer.
Full record and what to do →NVD record roytanck.com securityfocus.com
Dec 2, 2009Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and eCVE-2009-4168 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.
Product
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus
Affected
up to 2.0
Fixed in
1.23
What to do
Update Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus to 1.23 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Nov 17, 2009wp-admin/press-this.php in WordPress before 2.8.6: Cross-site scripting (XSS)CVE-2009-3891 · WordPress plugins & themes · reported by Red HatLow 3.5
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).
Product
wp-admin/press-this.php in WordPress before 2.8.6
Fixed in
2.8.6
What to do
Update wp-admin/press-this.php in WordPress before 2.8.6 to 2.8.6 or newer.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Sep 8, 2009wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for: Cross-site scripting (XSS)CVE-2008-7175 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.
Product
wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for
Affected
up to 0.96
What to do
Affects up to 0.96. Update wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org securityfocus.com
Aug 18, 2009the administrator interface in WordPress before 2.8.2: Cross-site scripting (XSS)CVE-2009-2851 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.
Product
the administrator interface in WordPress before 2.8.2
Fixed in
2.8.2
What to do
Update the administrator interface in WordPress before 2.8.2 to 2.8.2 or newer.
Full record and what to do →NVD record bugs.gentoo.org securitytracker.com
Mar 19, 2009the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU: Cross-site scripting (XSS)CVE-2009-1030 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
Product
the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU
Fixed in
2.7
What to do
Update the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU to 2.7 or newer.
Full record and what to do →NVD record marc.info securityfocus.com
Nov 28, 2008the self_link function in in the RSS Feed Generator: Cross-site scripting (XSS)CVE-2008-5278 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable).
Product
the self_link function in in the RSS Feed Generator
Fixed in
2.6.5
What to do
Update the self_link function in in the RSS Feed Generator to 2.6.5 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 24, 2008Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitraryCVE-2008-4733 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) replytotext, (2) quotetext, (3) originallypostedby, (4) sep, (5) maxtags, (6) tagsep, (7) tagheadersep, (8) taglabel, and (9) tagheaderlabel parameters.
Product
Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix
Fixed in
1.4.4
What to do
Update Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix to 1.4.4 or newer.
Full record and what to do →NVD record chxsecurity.org secunia.com
Oct 22, 2008wp-admin/wp-blogs.php in Wordpress MU: Cross-site scripting (XSS)CVE-2008-4671 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) s and (2) ip_address parameters.
Product
wp-admin/wp-blogs.php in Wordpress MU
Fixed in
2.6
What to do
Update wp-admin/wp-blogs.php in Wordpress MU to 2.6 or newer.
Full record and what to do →NVD record lists.grok.org.uk secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.