Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,775 results · page 28 of 36

Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of theCVE-2020-9455 · WordPress plugins & themes · reported by MITREMedium 4.3
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 13, 2020Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the polliCVE-2013-1400 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Feb 8, 2020Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SCVE-2015-2062 · WordPress plugins & themes · reported by MITREHigh 7.2
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts or edit_cat action in the sliders_huge_it_slider page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image)
Fixed in
2.7.0
What to do
Update Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) to 2.7.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Feb 8, 2020Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitraryCVE-2015-1394 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery
Fixed in
1.2.11
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery to 1.2.11 or newer.
Full record and what to do →NVD record securityfocus.com plugins.trac.wordpress.org
Jan 30, 2020Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web scCVE-2013-4241 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
Product
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials
Fixed in
2.0.11
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.
Full record and what to do →NVD record seclists.org seclists.org
Jan 28, 2020Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parametCVE-2013-2714 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parameter.
Affected
8.8.10.13 to 8.8.10.13
What to do
Affects 8.8.10.13 to 8.8.10.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jan 23, 2020WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.CVE-2012-6649 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.
Affected
1.1.21 to 1.1.21
What to do
Affects 1.1.21 to 1.1.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 15, 2020Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTMCVE-2015-5484 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post.
Product
Cross-site scripting (XSS) vulnerability in the Plotly
Fixed in
1.0.3
What to do
Update Cross-site scripting (XSS) vulnerability in the Plotly to 1.0.3 or newer.
Full record and what to do →NVD record seclists.org security.dxw.com
Jan 13, 2020WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite VulnerabilityCVE-2014-6059 · WordPress plugins & themes · reported by MITREHigh 7.2
WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability
Fixed in
2.8.2
What to do
Update the plugin to 2.8.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jan 6, 2020Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web scrCVE-2015-4039 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2.
Product
WP Membership
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update WP Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jan 2, 2020Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTMCVE-2014-4553 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters.
Product
spreadshirt-rss-3d-cube-flash-gallery
Affected
2014 to 2014
What to do
Affects 2014 to 2014. Update spreadshirt-rss-3d-cube-flash-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script CVE-2014-4535 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
Product
Import Legacy Media
Affected
up to 0.1
What to do
Affects up to 0.1. Update Import Legacy Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script orCVE-2014-4544 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php.
Product
Podcast Channels
Affected
up to 0.20
What to do
Affects up to 0.20. Update Podcast Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2014-4539 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
Product
Movies
Affected
up to 0.6
What to do
Affects up to 0.6. Update Movies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2014-4519 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the 'page' parameter.
Product
Conversador
Affected
up to 2.61
What to do
Affects up to 2.61. Update Conversador to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web scriptCVE-2014-4523 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Product
Easy Career Openings
Affected
up to 0.4
What to do
Affects up to 0.4. Update Easy Career Openings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 26, 2019WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code.CVE-2013-2011 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009.
Fixed in
1.3.2
What to do
Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.CVE-2019-17234 · WordPress plugins & themes · reported by MITREHigh 7.5
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
Product
includes/class-coming-soon-creator.php in the igniteup
Affected
up to 3.4
What to do
Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Nov 6, 2019The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary userCVE-2014-9013 · WordPress plugins & themes · reported by MITREHigh 8.8
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.
Product
WP Marketplace
Affected
2.4.0 to 2.4.0
What to do
Affects 2.4.0 to 2.4.0. Update WP Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 10, 2019The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1CVE-2015-9479 · WordPress plugins & themes · reported by MITRECritical 9.8
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
Product
ACF-Frontend-Display
Affected
up to 2015-07-03
What to do
Affects up to 2015-07-03. Update ACF-Frontend-Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 10, 2019The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.CVE-2015-9471 · WordPress plugins & themes · reported by MITRECritical 9.8
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.
Product
dzs-zoomsounds
Affected
up to 2.0
What to do
Affects up to 2.0. Update dzs-zoomsounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Oct 3, 2019A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or otheCVE-2019-16931 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
Product
Visualizer
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Visualizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record nathandavison.com wordpress.org
Sep 27, 2019In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full paCVE-2019-16902 · WordPress plugins & themes · reported by MITREHigh 7.5
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.
Product
ARforms
Affected
3.7.1 to 3.7.1
What to do
Affects 3.7.1 to 3.7.1. Update ARforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record almorabea.net arformsplugin.com
Sep 20, 2019Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a ..CVE-2015-9406 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.
Product
Directory traversal vulnerability in the mTheme-Unus
Fixed in
2.3
What to do
Update Directory traversal vulnerability in the mTheme-Unus to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 20, 2019The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.CVE-2014-10397 · WordPress plugins & themes · reported by MITREHigh 7.5
The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.
Product
Antioch
Affected
up to 2014-09-07
What to do
Affects up to 2014-09-07. Update Antioch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 20, 2019The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.CVE-2014-10396 · WordPress plugins & themes · reported by MITREHigh 7.5
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.
Product
epic
Affected
up to 2014-09-07
What to do
Affects up to 2014-09-07. Update epic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 20, 2019The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.CVE-2015-9402 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
Product
users-ultra
Fixed in
1.5.59
What to do
Update users-ultra to 1.5.59 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.CVE-2016-10997 · WordPress plugins & themes · reported by MITREMedium 6.5
The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Sep 18, 2019The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.CVE-2016-10995 · WordPress plugins & themes · reported by MITRECritical 9.8
The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.
Product
Tevolution
Fixed in
2.3.0
What to do
Update Tevolution to 2.3.0 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 16, 2019The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.CVE-2016-10959 · WordPress plugins & themes · reported by MITREMedium 6.5
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
Product
estatik
Fixed in
2.3.1
What to do
Update estatik to 2.3.1 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Sep 16, 2019The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.CVE-2016-10958 · WordPress plugins & themes · reported by MITREHigh 7.5
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.
Product
estatik
Fixed in
2.3.0
What to do
Update estatik to 2.3.0 or newer.
Full record and what to do →NVD record estatik.net wordpress.org
Sep 3, 2019The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.CVE-2019-15866 · WordPress plugins & themes · reported by MITREHigh 8.8
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.
Product
crelly-slider
Fixed in
1.3.5
What to do
Update crelly-slider to 1.3.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 28, 2019The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.CVE-2017-18593 · WordPress plugins & themes · reported by MITREMedium 6.1
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
Product
updraftplus
Fixed in
1.13.5
What to do
Update updraftplus to 1.13.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.CVE-2019-15330 · WordPress plugins & themes · reported by MITREHigh 7.5
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.
Product
webp-express
Fixed in
0.14.11
What to do
Update webp-express to 0.14.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.CVE-2014-10385 · WordPress plugins & themes · reported by MITREMedium 6.1
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.CVE-2014-10384 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.CVE-2014-10383 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.CVE-2018-20982 · WordPress plugins & themes · reported by MITREMedium 6.1
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
Product
media-library-assistant
Fixed in
2.74
What to do
Update media-library-assistant to 2.74 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.CVE-2017-18540 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.7
What to do
Update weblibrarian to 3.4.8.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.CVE-2017-18539 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.6
What to do
Update weblibrarian to 3.4.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.CVE-2017-18538 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.5
What to do
Update weblibrarian to 3.4.8.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 29, 2019The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_foCVE-2019-6726 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header.
Product
WP Fastest Cache
Affected
up to 0.8.9.0
What to do
Affects up to 0.8.9.0. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jul 21, 2019An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via tCVE-2019-14206 · WordPress plugins & themes · reported by MITREHigh 7.5
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php.
Product
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images
Fixed in
0.6.67
What to do
Update An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images to 0.6.67 or newer.
Full record and what to do →NVD record github.com markgruffer.github.io
Jul 21, 2019A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via theCVE-2019-14205 · WordPress plugins & themes · reported by MITREHigh 7.5
A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.
Product
A Local File Inclusion vulnerability in the Nevma Adaptive Images
Fixed in
0.6.67
What to do
Update A Local File Inclusion vulnerability in the Nevma Adaptive Images to 0.6.67 or newer.
Full record and what to do →NVD record github.com markgruffer.github.io
Jul 15, 2019Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection.CVE-2019-1010034 · WordPress plugins & themes · reported by josh@bress.netMedium 6.5
Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection. This function call can be triggered by any user logged-in with at least Volunteer role or manage_circulation capabilities. PoC : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=DESC.
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpvulndb.com
Jul 3, 2019A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQCVE-2019-12570 · WordPress plugins & themes · reported by MITREHigh 8.8
A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters.
Product
Xpert Solution "Server Status by Hostname/IP
Affected
4.6 to 4.6
What to do
Affects 4.6 to 4.6. Update Xpert Solution "Server Status by Hostname/IP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jun 21, 2019An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10270 · WordPress plugins & themes · reported by MITREHigh 8.8
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation.
Product
Ultimate Member
Fixed in
2.0.40
What to do
Update Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jun 3, 2019The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.CVE-2019-11185 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
Product
WP Live Chat Support Pro
Affected
up to 8.0.26
What to do
Affects up to 8.0.26. Update WP Live Chat Support Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wp-livechat.com
May 13, 2019Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web scripCVE-2019-7411 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL).
Product
MyThemeShop Launcher
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update MyThemeShop Launcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record metamorfosec.com wpvulndb.com
Apr 23, 2019The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GETCVE-2019-10864 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
Product
WP Statistics
Affected
up to 12.6.2
What to do
Affects up to 12.6.2. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com medium.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.