Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

1,328 results · page 26 of 27

Sep 26, 2019The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to impCVE-2019-16524 · WordPress plugins & themes · reported by MITREMedium 4.8
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.
Product
easy-fancybox
Fixed in
1.8.18
What to do
Update easy-fancybox to 1.8.18 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 25, 2019The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or taCVE-2015-9434 · WordPress plugins & themes · reported by MITREMedium 6.5
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Product
kiwi-logo-carousel
Fixed in
1.7.2
What to do
Update kiwi-logo-carousel to 1.7.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.CVE-2016-11006 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 17, 2019The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.CVE-2016-10982 · WordPress plugins & themes · reported by MITREHigh 8.8
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
Product
kento-post-view-counter
Affected
up to 2.8
What to do
Affects up to 2.8. Update kento-post-view-counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org openwall.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-15872 · WordPress plugins & themes · reported by MITRECritical 9.8
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.CVE-2019-15871 · WordPress plugins & themes · reported by MITREMedium 4.3
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.CVE-2019-15831 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
Product
visitors-traffic-real-time-statistics
Fixed in
1.12
What to do
Update visitors-traffic-real-time-statistics to 1.12 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.CVE-2019-15821 · WordPress plugins & themes · reported by MITREHigh 7.5
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Product
bold-page-builder
Fixed in
2.3.2
What to do
Update bold-page-builder to 2.3.2 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.CVE-2019-15820 · WordPress plugins & themes · reported by MITREMedium 6.1
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
Product
login-or-logout-menu-item
Fixed in
1.2.0
What to do
Update login-or-logout-menu-item to 1.2.0 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15819 · WordPress plugins & themes · reported by MITRECritical 9.8
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Product
nd-restaurant-reservations
Fixed in
1.5
What to do
Update nd-restaurant-reservations to 1.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.CVE-2019-15816 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
Product
wp-private-content-plus
Fixed in
2.0
What to do
Update wp-private-content-plus to 2.0 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 29, 2019The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15771 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-shortcodes
Fixed in
6.0
What to do
Update nd-shortcodes to 6.0 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.CVE-2019-15777 · WordPress plugins & themes · reported by MITREMedium 5.4
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
Product
shapepress-dsgvo
Fixed in
2.2.19
What to do
Update shapepress-dsgvo to 2.2.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15775 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-learning
Fixed in
4.8
What to do
Update nd-learning to 4.8 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15774 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-booking
Fixed in
2.5
What to do
Update nd-booking to 2.5 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15773 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-travel
Fixed in
1.7
What to do
Update nd-travel to 1.7 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15772 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-donations
Fixed in
1.4
What to do
Update nd-donations to 1.4 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 22, 2019The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.CVE-2017-18584 · WordPress plugins & themes · reported by MITREHigh 7.5
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
Product
post-pay-counter
Fixed in
2.731
What to do
Update post-pay-counter to 2.731 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.CVE-2018-20982 · WordPress plugins & themes · reported by MITREMedium 6.1
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
Product
media-library-assistant
Fixed in
2.74
What to do
Update media-library-assistant to 2.74 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.CVE-2018-20977 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
Product
all-in-one-schemaorg-rich-snippets
Fixed in
1.5.0
What to do
Update all-in-one-schemaorg-rich-snippets to 1.5.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.CVE-2016-10899 · WordPress plugins & themes · reported by MITREMedium 5.3
The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
Product
total-security
Fixed in
3.4.1
What to do
Update total-security to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.CVE-2017-18531 · WordPress plugins & themes · reported by MITREMedium 6.1
The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
Product
raygun4wp
Fixed in
1.8.3
What to do
Update raygun4wp to 1.8.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.CVE-2019-14786 · WordPress plugins & themes · reported by MITREMedium 6.5
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.
Fixed in
1.0.27.1
What to do
Update the plugin to 1.0.27.1 or newer.
Full record and what to do →NVD record rankmath.com wpvulndb.com
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.CVE-2016-10867 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.6
What to do
Update all-in-one-wp-security-and-firewall to 4.0.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.CVE-2016-10871 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
Product
mailchimp-for-wp
Fixed in
4.0.11
What to do
Update mailchimp-for-wp to 4.0.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.CVE-2016-10868 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.5
What to do
Update all-in-one-wp-security-and-firewall to 4.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.CVE-2017-18506 · WordPress plugins & themes · reported by MITREMedium 6.1
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
Product
woocommerce-pdf-invoices-packing-slips
Fixed in
2.0.13
What to do
Update woocommerce-pdf-invoices-packing-slips to 2.0.13 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 8, 2019The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.CVE-2019-14681 · WordPress plugins & themes · reported by MITREHigh 8.8
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
Product
Deny All Firewall
Fixed in
1.1.7
What to do
Update Deny All Firewall to 1.1.7 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Jul 30, 2019A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.CVE-2019-14327 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
Product
Custom Simple Rss
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Custom Simple Rss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 5, 2019An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings.CVE-2019-13344 · WordPress plugins & themes · reported by MITREMedium 5.3
An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter.
Product
An authentication bypass vulnerability in the CRUDLab WP Like Button
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update An authentication bypass vulnerability in the CRUDLab WP Like Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com limbenjamin.com
Jun 21, 2019An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10270 · WordPress plugins & themes · reported by MITREHigh 8.8
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation.
Product
Ultimate Member
Fixed in
2.0.40
What to do
Update Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, whicCVE-2018-19488 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account.
Product
WP-jobhunt
Fixed in
2.4
What to do
Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXMLCVE-2015-4615 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables
Affected
1.09 to 1.09
What to do
Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org wordpress.org
Dec 22, 2018The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.CVE-2018-20368 · WordPress plugins & themes · reported by MITREMedium 5.4
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Nov 28, 2018A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allowsCVE-2018-19370 · WordPress plugins & themes · reported by MITREMedium 6.6
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
Product
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo)
Fixed in
9.2.0
What to do
Update A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) to 9.2.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 7, 2018The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transienCVE-2018-16363 · WordPress plugins & themes · reported by MITREMedium 5.4
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
Affected
2.9 to 2.9
What to do
Affects 2.9 to 2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.51cto.com plugins.trac.wordpress.org
Jul 4, 2018The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.CVE-2018-13136 · WordPress plugins & themes · reported by MITREMedium 6.1
The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.
Product
Ultimate Member (aka ultimatemember)
Fixed in
2.0.18
What to do
Update Ultimate Member (aka ultimatemember) to 2.0.18 or newer.
Full record and what to do →NVD record github.com github.com
May 30, 2018class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change VulnerCVE-2018-11579 · WordPress plugins & themes · reported by MITREMedium 5.3
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
Product
MULTIDOTS WooCommerce Category Banner Management
Affected
1.1.0 to 1.1.0
What to do
Affects 1.1.0 to 1.1.0. Update MULTIDOTS WooCommerce Category Banner Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com wordpress.org
Apr 7, 2018The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.CVE-2018-9844 · WordPress plugins & themes · reported by MITREMedium 6.1
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.
Product
Iptanus WordPress File Upload
Fixed in
4.3.4
What to do
Update Iptanus WordPress File Upload to 4.3.4 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jan 12, 2018The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5374 · WordPress plugins & themes · reported by MITREHigh 8.8
The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
Product
Dbox 3D Slider Lite
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Dbox 3D Slider Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 12, 2018The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5372 · WordPress plugins & themes · reported by MITREHigh 8.8
The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
Product
Testimonial Slider
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Dec 2, 2017wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackerCVE-2017-17091 · WordPress plugins & themes · reported by MITREHigh 8.8
wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.
Fixed in
4.9.1
What to do
Update the plugin to 4.9.1 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Nov 16, 2017CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the pluginCVE-2017-1000224 · WordPress plugins & themes · reported by MITREMedium 6.5
CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin
Affected
up to 11.8.1
What to do
Affects up to 11.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Oct 23, 2017The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.CVE-2017-15812 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
Product
Easy Appointments
Fixed in
1.12.0
What to do
Update Easy Appointments to 1.12.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 23, 2017The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.CVE-2017-15811 · WordPress plugins & themes · reported by MITREMedium 5.4
The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.
Product
Pootle Button
Fixed in
1.2.0
What to do
Update Pootle Button to 1.2.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Oct 6, 2017Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attacCVE-2014-8492 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) site_name, (2) message, or (3) site_url parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder
Fixed in
2.0.3
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder to 2.0.3 or newer.
Full record and what to do →NVD record g0blin.co.uk wpvulndb.com
Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallerCVE-2017-1002015 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter.
Affected
1.5.2 to 1.5.2
What to do
Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name paCVE-2017-1002014 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter.
Affected
1.5.2 to 1.5.2
What to do
Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.phpCVE-2017-1002013 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php.
Affected
1.5.2 to 1.5.2
What to do
Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.