Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

1,597 results · page 28 of 32

Nov 4, 2014SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the caliCVE-2014-8586 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter.
Product
CP Multi View Event Calendar
What to do
Update CP Multi View Event Calendar to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Oct 31, 2014The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacteCVE-2014-8334 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.
Product
WP-DBManager (aka Database Manager)
Fixed in
2.7.2
What to do
Update WP-DBManager (aka Database Manager) to 2.7.2 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Oct 27, 2014Multiple cross-site scripting (XSS) vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remote attackers to inject arbitrary web scripCVE-2014-4586 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the league parameter to (1) football_classification.php, (2) football_criteria.php, (3) templates/template_default_preview.php, or (4) templates/template_worldCup_preview.php; the (5) f parameter to football-functions.php; the id parameter in an "action" action to (6) football_groups_list.php, (7) football_matches_list.php, (8) football_matches_phase.php, or (9) football_phases_list.php; or the (10) id_league parameter in a delete action to football_matches_load.php.
Product
wp-football
Affected
up to 1.1
What to do
Affects up to 1.1. Update wp-football to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Oct 22, 2014Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web scriCVE-2014-7182 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the poly_id parameter in an (1) edit_poly, (2) edit_polyline, or (3) edit_marker action in the wp-google-maps-menu page to wp-admin/admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps
Fixed in
6.0.27
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps to 6.0.27 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 21, 2014SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commandsCVE-2014-8375 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php.
Product
GB Gallery Slideshow
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com homelab.it
Oct 20, 2014Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to inject arbitCVE-2014-8364 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ss_id parameter.
Product
WordPress Spreadsheet (wpSS)
Affected
0.62 to 0.62
What to do
Affects 0.62 to 0.62. Update WordPress Spreadsheet (wpSS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 20, 2014SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execute arbitrary SQL comCVE-2014-8363 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.
Product
WordPress Spreadsheet (wpSS)
Affected
0.62 to 0.62
What to do
Affects 0.62 to 0.62. Update WordPress Spreadsheet (wpSS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web scriptCVE-2014-7181 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page.
Product
Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons
Fixed in
1.26.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons to 1.26.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script CVE-2014-7138 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the Google Calendar Events
Fixed in
2.0.4
What to do
Update Cross-site scripting (XSS) vulnerability in the Google Calendar Events to 2.0.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 14, 2014Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2014-6313 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.2.3 or newer.
Full record and what to do →NVD record seclists.org secunia.com
Oct 10, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbCVE-2014-6315 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback, (2) dir, or (3) extensions parameter in an addImages action to wp-admin/admin-ajax.php.
Product
Web-Dorado Photo Gallery
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update Web-Dorado Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Oct 10, 2014Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script orCVE-2014-6243 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngout error message.
Product
Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer
Fixed in
2.0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer to 2.0.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 6, 2014SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQCVE-2014-5389 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php.
Product
SQL injection vulnerability in content-audit-schedule.php in the Content Audit
Fixed in
1.6.1
What to do
Update SQL injection vulnerability in content-audit-schedule.php in the Content Audit to 1.6.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 26, 2014Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web scriCVE-2014-7152 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the update_options action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.g0blin.co.uk wordpress.org
Sep 26, 2014The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary fiCVE-2014-6446 · WordPress plugins & themes · reported by MITREHigh 7.5
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Product
Infusionsoft Gravity Forms plugin 1.5.3
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update Infusionsoft Gravity Forms plugin 1.5.3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Sep 26, 2014Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP cCVE-2014-5324 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file.
Product
Unrestricted file upload vulnerability in the N-Media file uploader
Fixed in
3.4
What to do
Update Unrestricted file upload vulnerability in the N-Media file uploader to 3.4 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Sep 11, 2014Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitraCVE-2014-5460 · WordPress plugins & themes · reported by MITREMedium 6.5
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.
Product
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery
Fixed in
1.4.7
What to do
Update Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery to 1.4.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Sep 4, 2014Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2012-4768 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.
Product
Cross-site scripting (XSS) vulnerability in the Download Monitor
Fixed in
3.3.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in the Download Monitor to 3.3.5.9 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Sep 3, 2014Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitraCVE-2014-5465 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Product
Download Shortcode
Affected
up to 0.2.3
What to do
Affects up to 0.2.3. Update Download Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTMCVE-2012-4226 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Title, (2) Content, or (3) New category field to wordpress/ or (4) query string to wordpress/.
Affected
1.9.1 to 1.9.1
What to do
Affects 1.9.1 to 1.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Aug 19, 2014Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrarCVE-2014-5345 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
Product
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System
Fixed in
2.76
What to do
Update Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System to 2.76 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 19, 2014Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbitrary web script or CVE-2014-3903 · WordPress plugins & themes · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via crafted Exif data.
Product
Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x
Fixed in
1.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x to 1.6.2 or newer.
Full record and what to do →NVD record jayj.dk jvn.jp
Aug 18, 2014wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code vCVE-2014-5203 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.
Fixed in
3.9.2
What to do
Update the plugin to 3.9.2 or newer.
Full record and what to do →NVD record openwall.com core.trac.wordpress.org
Aug 12, 2014Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitraryCVE-2014-5202 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the search-value parameter.
Product
Compfight
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update Compfight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org packetstormsecurity.com
Aug 12, 2014SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter iCVE-2014-5201 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a go_view_object action to wp-admin/admin-ajax.php.
Product
Gallery Objects
Affected
0.4 to 0.4
What to do
Affects 0.4 to 0.4. Update Gallery Objects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com homelab.it
Aug 6, 2014Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter tCVE-2014-5187 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.
Product
Tom M8te (tom-m8te)
Affected
1.5.3 to 1.5.3
What to do
Affects 1.5.3 to 1.5.3. Update Tom M8te (tom-m8te) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrarCVE-2014-5186 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogallery_videos page to wp-admin/admin.php.
Product
All Video Gallery (all-video-gallery)
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update All Video Gallery (all-video-gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL comCVE-2014-5185 · WordPress plugins & themes · reported by MITREMedium 6
SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands via the quote parameter in an edit action in the quartz/quote_form.php page to wp-admin/edit.php.
Product
Quartz
Affected
1.01.1 to 1.01.1
What to do
Affects 1.01.1 to 1.01.1. Update Quartz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SCVE-2014-5182 · WordPress plugins & themes · reported by MITREMedium 6
Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via vectors related to (1) admin_functions.php or (2) admin_update.php, as demonstrated by the id parameter in the update action to wp-admin/admin.php.
Product
yawpp
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update yawpp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wordpress.org
Aug 6, 2014Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attackers to read arbitraCVE-2014-5181 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the snode parameter.
Product
Last.fm Rotation (lastfm-rotation)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Last.fm Rotation (lastfm-rotation) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 31, 2014Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a ..CVE-2012-6651 · WordPress plugins & themes · reported by MITREMedium 5
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.
Product
Multiple directory traversal vulnerabilities in the Vitamin
Fixed in
1.1.0
What to do
Update Multiple directory traversal vulnerabilities in the Vitamin to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org openwall.com
Jul 27, 2014The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code CVE-2014-4725 · WordPress plugins & themes · reported by MITREHigh 7.5
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.
Product
MailPoet Newsletters (wysija-newsletters)
Fixed in
2.6.7
What to do
Update MailPoet Newsletters (wysija-newsletters) to 2.6.7 or newer.
Full record and what to do →NVD record arstechnica.com blog.sucuri.net
Jul 11, 2014Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a ..CVE-2014-4940 · WordPress plugins & themes · reported by MITREMedium 5
Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.
Affected
0.1 to 0.1
What to do
Affects 0.1 to 0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Jul 11, 2014SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQCVE-2014-4939 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php.
Product
ENL Newsletter (enl-newsletter)
Affected
1.0.1 to 1.0.1
What to do
Affects 1.0.1 to 1.0.1. Update ENL Newsletter (enl-newsletter) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 11, 2014SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the idCVE-2014-4938 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php.
Product
WP Rss Poster (wp-rss-poster)
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update WP Rss Poster (wp-rss-poster) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inject arbitrary web scrCVE-2014-4856 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a ratings shortcode and a unique ID. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings
Fixed in
2.0.25
What to do
Update Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings to 2.0.25 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via veCVE-2014-4855 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the Polylang
Fixed in
1.5.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Polylang to 1.5.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2014-4854 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuc_logo parameter in a save action to wp-admin/admin.php.
Product
WP Construction Mode
Affected
1.8 to 1.8
What to do
Affects 1.8 to 1.8. Update WP Construction Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers to inject arbitrary wCVE-2014-4848 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bs_blog_id parameter to wp-admin/options-general.php.
Product
Blogstand Banner (blogstand-smart-banner)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Blogstand Banner (blogstand-smart-banner) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via thCVE-2014-4847 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the buffercode_RBanner_url_banner1 parameter in an update action to wp-admin/options.php.
Product
Random Banner
Affected
1.1.2.1 to 1.1.2.1
What to do
Affects 1.1.2.1 to 1.1.2.1. Update Random Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML CVE-2014-4846 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php.
Product
Meta Slider (ml-slider)
Affected
2.5 to 2.5
What to do
Affects 2.5 to 2.5. Update Meta Slider (ml-slider) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannCVE-2014-4845 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannerman_background parameter to wp-admin/options-general.php.
Product
BannerMan
Affected
0.2.4 to 0.2.4
What to do
Affects 0.2.4 to 0.2.4. Update BannerMan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 7, 2014Cross-site scripting (XSS) vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2014-4724 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_banners_registered_name parameter to wp-admin/options.php.
Product
Custom Banners
Affected
1.2.2.2 to 1.2.2.2
What to do
Affects 1.2.2.2 to 1.2.2.2. Update Custom Banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 7, 2014Cross-site scripting (XSS) vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the namCVE-2014-4723 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter to wp-admin/options-general.php.
Product
Easy Banners
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update Easy Banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations plugin before 1.4.4.3 for WordPress allows remote attackers to inject arbitrarCVE-2014-4597 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations plugin before 1.4.4.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xhrurl parameter.
Product
Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations
Fixed in
1.4.4.3
What to do
Update Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations to 1.4.4.3 or newer.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Jul 2, 2014Cross-site scripting (XSS) vulnerability in picasa_upload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote attackers to inject arbiCVE-2014-4591 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in picasa_upload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.
Product
WP-Picasa-Image
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP-Picasa-Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject arbitrary web scripCVE-2014-4581 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
WPCB
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update WPCB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbCVE-2014-4571 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fs or (2) w parameter.
Product
VN-Calendar
Affected
up to 1.0
What to do
Affects up to 1.0. Update VN-Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com securityfocus.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitraryCVE-2014-4555 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
Product
Style It
Affected
up to 1.0
What to do
Affects up to 1.0. Update Style It to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads plugin before 1.5 for WordPress allows remote attackers to inject arbitraCVE-2014-4554 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads plugin before 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title parameter.
Product
Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads
Fixed in
1.5
What to do
Update Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads to 1.5 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.