Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,775 results · page 29 of 36

Apr 18, 2019An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading CVE-2019-11223 · WordPress plugins & themes · reported by MITRECritical 9.8
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Product
An Unrestricted File Upload Vulnerability in the SupportCandy
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update An Unrestricted File Upload Vulnerability in the SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.kalasag.com.ph wordpress.org
Apr 1, 2019pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionCoCVE-2019-6715 · WordPress plugins & themes · reported by MITREHigh 7.5
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.
Product
pub/sns.php in the W3 Total Cache
Fixed in
0.9.4
What to do
Update pub/sns.php in the W3 Total Cache to 0.9.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com vinhjaxt.github.io
Feb 19, 2019WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, sucCVE-2019-8942 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com rapid7.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the diCVE-2018-19043 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mreloCVE-2018-19042 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Dec 14, 2018The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multCVE-2018-20156 · WordPress plugins & themes · reported by MITREHigh 7.2
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network.
Product
WP Maintenance Mode
Fixed in
2.0.7
What to do
Update WP Maintenance Mode to 2.0.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Nov 12, 2018The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepaCVE-2018-19207 · WordPress plugins & themes · reported by MITRECritical 9.8
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.
Product
Van Ons WP GDPR Compliance (aka wp-gdpr-compliance)
Fixed in
1.4.3
What to do
Update Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) to 1.4.3 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Oct 18, 2018The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code inCVE-2018-18461 · WordPress plugins & themes · reported by MITRECritical 9.8
The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments[] data to models/attachment.php.
Affected
2.5.1.7 to 2.5.1.7
What to do
Affects 2.5.1.7 to 2.5.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Oct 5, 2018The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safCVE-2015-9272 · WordPress plugins & themes · reported by MITRECritical 9.8
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Affected
3.31.17 to 3.31.17
What to do
Affects 3.31.17 to 3.31.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com openwall.com
Oct 4, 2018The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.phCVE-2015-9271 · WordPress plugins & themes · reported by MITRECritical 9.8
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
Affected
4.91.8 to 4.91.8
What to do
Affects 4.91.8 to 4.91.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com vapidlabs.com
Sep 28, 2018The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editCVE-2018-17573 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editor/filemanager/browser/default/browser.html, fckeditor/editor/filemanager/connectors/test.html, and fckeditor/editor/filemanager/connectors/uploadtest.html.
Product
Wp-Insert
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Wp-Insert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cxsecurity.com packetstormsecurity.com
Aug 28, 2018Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2014-4932 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
Product
Cross-site scripting (XSS) vulnerability in the Wordfence Security
Fixed in
5.1.5
What to do
Update Cross-site scripting (XSS) vulnerability in the Wordfence Security to 5.1.5 or newer.
Full record and what to do →NVD record techdefencelabs.com wordfence.com
Jun 26, 2018WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passeCVE-2018-12895 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.
Affected
up to 4.9.6
What to do
Affects up to 4.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2018SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation CVE-2018-10969 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.
Product
SQL injection vulnerability in the Pie Register
Fixed in
3.0.10
What to do
Update SQL injection vulnerability in the Pie Register to 3.0.10 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Apr 25, 2018The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters iCVE-2014-5014 · WordPress plugins & themes · reported by MITRECritical 9.8
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
Product
WordPress Flash Uploader
Fixed in
3.1.3
What to do
Update WordPress Flash Uploader to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 23, 2018Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2018-10300 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio.
Product
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD
Fixed in
1.3.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD to 1.3.1 or newer.
Full record and what to do →NVD record medium.com wpvulndb.com
Apr 20, 2018Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web sCVE-2018-7747 · WordPress plugins & themes · reported by MITREMedium 4.8
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email transaction log, or (3) an imported form.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms
Fixed in
1.6.0-rc.1
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms to 1.6.0-rc.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com calderaforms.com
Apr 10, 2018The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd paCVE-2014-3114 · WordPress plugins & themes · reported by MITRECritical 9.8
The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php.
Affected
up to 12.03.10
What to do
Affects up to 12.03.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Apr 10, 2018The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveragiCVE-2014-1889 · WordPress plugins & themes · reported by MITREMedium 6.5
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.
Product
Group creation process in the Buddypress
Fixed in
1.9.2
What to do
Update Group creation process in the Buddypress to 1.9.2 or newer.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Mar 19, 2018Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2014-2674 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the loop parameter in an ajax_navigation action to wp-admin/admin-ajax.php.
Product
Ajax Pagination (twitter Style)
Affected
1.1 to 1.1
What to do
Affects 1.1 to 1.1. Update Ajax Pagination (twitter Style) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Mar 19, 2018A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_pathCVE-2018-7422 · WordPress plugins & themes · reported by MITREHigh 7.5
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
Product
A Local File Inclusion vulnerability in the Site Editor
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update A Local File Inclusion vulnerability in the Site Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wpvulndb.com
Mar 15, 2018Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript CVE-2018-8729 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log
Fixed in
2.4.1
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log to 2.4.1 or newer.
Full record and what to do →NVD record github.com github.com
Feb 8, 2018Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2015-2329 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.3.6
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.3.6 or newer.
Full record and what to do →NVD record fortiguard.com raw.githubusercontent.com
Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6469 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_tags parameter to wp-admin/options-general.php.
Product
flickrRSS
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6468 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_id parameter to wp-admin/options-general.php.
Product
flickrRSS
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6466 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_set parameter to wp-admin/options-general.php.
Product
flickrRSS
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 8, 2018Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploCVE-2014-4972 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
Product
Gravity Upload Ajax
Affected
up to 1.1
What to do
Affects up to 1.1. Update Gravity Upload Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record g0blin.co.uk wpvulndb.com
Jan 5, 2018The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveragingCVE-2014-8336 · WordPress plugins & themes · reported by MITREMedium 6.5
The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.
Product
Sql Run Query" panel in WP-DBManager (aka Database Manager)
Fixed in
2.7.2
What to do
Update Sql Run Query" panel in WP-DBManager (aka Database Manager) to 2.7.2 or newer.
Full record and what to do →NVD record openwall.com vapid.dhs.org
Jan 1, 2018Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrarCVE-2018-3810 · WordPress plugins & themes · reported by MITRECritical 9.8
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.
Product
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter
Fixed in
3.5
What to do
Update Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter to 3.5 or newer.
Full record and what to do →NVD record limbenjamin.com wordpress.org
Dec 19, 2017Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary webCVE-2017-17753 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cie_type, (2) cie_import, (3) cie_update, or (4) cie_ignore parameter to includes/admin/views/esb-cie-import-export-page.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export
Affected
up to 1.1
What to do
Affects up to 1.1. Update Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
Dec 19, 2017A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2017-17744 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter to view/advancedsettings.php.
Product
A cross-site scripting (XSS) vulnerability in the custom-map
Affected
up to 1.1
What to do
Affects up to 1.1. Update A cross-site scripting (XSS) vulnerability in the custom-map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wpvulndb.com
Dec 19, 2017A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2017-17719 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the result_message parameter to includes/concours_page.php.
Product
A cross-site scripting (XSS) vulnerability in the wp-concours
Affected
up to 1.1
What to do
Affects up to 1.1. Update A cross-site scripting (XSS) vulnerability in the wp-concours to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wpvulndb.com
Dec 3, 2017Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via craftCVE-2017-17096 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via crafted OpenGraph data.
Product
Cross-site scripting (XSS) vulnerability in the Content Cards
Fixed in
0.9.7
What to do
Update Cross-site scripting (XSS) vulnerability in the Content Cards to 0.9.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Nov 27, 2017SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via the "keyword" paramCVE-2017-16955 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via the "keyword" parameter to /wp-admin/options-general.php?page=inlinks/inlinks.php.
Product
SQL injection vulnerability in the InLinks
Affected
up to 1.1
What to do
Affects up to 1.1. Update SQL injection vulnerability in the InLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Oct 24, 2017Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web CVE-2017-15867 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, (3) user_id, (4) username, (5) country_name, (6) browser, (7) operating_system, or (8) ip_address parameter to admin/partials/listing/listing.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Oct 19, 2017The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, reCVE-2015-6668 · WordPress plugins & themes · reported by MITREHigh 7.5
The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.
Product
Job Manager
Fixed in
0.7.25
What to do
Update Job Manager to 0.7.25 or newer.
Full record and what to do →NVD record vagmour.eu wpvulndb.com
Oct 18, 2017The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.CVE-2015-5227 · WordPress plugins & themes · reported by Red HatHigh 8.8
The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.
Product
Landing Pages
Fixed in
1.9.2
What to do
Update Landing Pages to 1.9.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 16, 2017SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_custCVE-2014-8621 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_custom_field parameter to sl-xml.php.
Product
SQL injection vulnerability in the Store Locator plugin 2.3
Affected
up to 3.11
What to do
Affects up to 3.11. Update SQL injection vulnerability in the Store Locator plugin 2.3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record g0blin.co.uk wpvulndb.com
Oct 16, 2017Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2014-8087 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/ph_save.php.
Product
Cross-site scripting (XSS) vulnerability in the post highlights
Fixed in
2.6.1
What to do
Update Cross-site scripting (XSS) vulnerability in the post highlights to 2.6.1 or newer.
Full record and what to do →NVD record g0blin.co.uk wordpress.org
Oct 6, 2017Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web scripCVE-2014-7240 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a master_response action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution
Fixed in
1.7
What to do
Update Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution to 1.7 or newer.
Full record and what to do →NVD record g0blin.co.uk wpvulndb.com
Oct 2, 2017Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web sCVE-2015-7357 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.
Product
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0
Fixed in
2.7.10
What to do
Update Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 to 2.7.10 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 28, 2017Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) tCVE-2017-14507 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php or (3) pages/content_timeline_index.php.
Product
Content Timeline
Affected
4.4.2 to 4.4.2
What to do
Affects 4.4.2 to 4.4.2. Update Content Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Sep 25, 2017SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the CVE-2017-14125 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to wp-admin/admin.php.
Product
SQL injection vulnerability in the Responsive Image Gallery
Fixed in
1.2.1
What to do
Update SQL injection vulnerability in the Responsive Image Gallery to 1.2.1 or newer.
Full record and what to do →NVD record seclists.org wpvulndb.com
Sep 19, 2017Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or CVE-2015-3299 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order.
Product
Cross-site scripting (XSS) vulnerability in the Floating Social Bar
Fixed in
1.1.7
What to do
Update Cross-site scripting (XSS) vulnerability in the Floating Social Bar to 1.1.7 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Sep 11, 2017Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web scrCVE-2015-8354 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php.
Product
Ultimate Member
Fixed in
1.3.29
What to do
Update Ultimate Member to 1.3.29 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 11, 2017Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2015-8353 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the Role Scoper
Fixed in
1.3.67
What to do
Update Cross-site scripting (XSS) vulnerability in the Role Scoper to 1.3.67 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 11, 2017Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web scriCVE-2015-8350 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action
Fixed in
2.5.1
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action to 2.5.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 7, 2017SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.CVE-2015-3314 · WordPress plugins & themes · reported by MITREHigh 8.1
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
Fixed in
1.5.5
What to do
Update the plugin to 1.5.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Sep 7, 2017SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questioCVE-2017-9834 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.
Product
SQL injection vulnerability in the WatuPRO
Fixed in
5.5.3.7
What to do
Update SQL injection vulnerability in the WatuPRO to 5.5.3.7 or newer.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Aug 29, 2017Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commaCVE-2015-7517 · WordPress plugins & themes · reported by Red HatCritical 9.8
Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or (2) class-doifd-landing-page.php in public/includes/.
Product
Multiple SQL injection vulnerabilities in the Double Opt-In for Download
Fixed in
2.0.9
What to do
Update Multiple SQL injection vulnerabilities in the Double Opt-In for Download to 2.0.9 or newer.
Full record and what to do →NVD record permalink.gmane.org securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.