Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

1,507 results · page 29 of 31

Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mreloCVE-2018-19042 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.CVE-2018-19041 · WordPress plugins & themes · reported by MITREMedium 6.1
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to CVE-2018-19040 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 9, 2019The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameCVE-2016-10736 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.
Product
Social Pug - Easy Social Share Buttons
Fixed in
1.2.6
What to do
Update Social Pug - Easy Social Share Buttons to 1.2.6 or newer.
Full record and what to do →NVD record advisories.dxw.com advisories.dxw.com
Oct 18, 2018XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page reCVE-2018-18460 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request.
Affected
8.0.15 to 8.0.15
What to do
Affects 8.0.15 to 8.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Oct 8, 2018process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_nCVE-2018-18069 · WordPress plugins & themes · reported by MITREMedium 6.1
process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.
Product
process_forms in the WPML (aka sitepress-multilingual-cms)
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update process_forms in the WPML (aka sitepress-multilingual-cms) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record 0x62626262.wordpress.com 0x62626262.wordpress.com
Oct 3, 2018The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.CVE-2018-17947 · WordPress plugins & themes · reported by MITREMedium 6.1
The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.
Product
Snazzy Maps
Fixed in
1.1.5
What to do
Update Snazzy Maps to 1.1.5 or newer.
Full record and what to do →NVD record defensecode.com seclists.org
Oct 3, 2018The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.CVE-2018-17946 · WordPress plugins & themes · reported by MITREMedium 6.1
The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.
Product
Tribulant Slideshow Gallery
Fixed in
1.6.6.1
What to do
Update Tribulant Slideshow Gallery to 1.6.6.1 or newer.
Full record and what to do →NVD record defensecode.com wordpress.org
Oct 1, 2018XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.CVE-2015-9270 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
Product
XSS exists in the the-holiday-calendar
Fixed in
1.11.3
What to do
Update XSS exists in the the-holiday-calendar to 1.11.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 24, 2018The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.CVE-2018-16299 · WordPress plugins & themes · reported by MITREHigh 7.5
The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org github.com
Sep 24, 2018The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.CVE-2018-16283 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org github.com
Sep 17, 2018The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.CVE-2018-17140 · WordPress plugins & themes · reported by MITREMedium 5.4
The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.
Product
Quizlord
Affected
up to 2.0
What to do
Affects up to 2.0. Update Quizlord to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 15, 2018The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.CVE-2018-17074 · WordPress plugins & themes · reported by MITREMedium 6.1
The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.
Product
Feed Statistics
Fixed in
4.0
What to do
Update Feed Statistics to 4.0 or newer.
Full record and what to do →NVD record hackerone.com plugins.trac.wordpress.org
Sep 7, 2018The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transienCVE-2018-16363 · WordPress plugins & themes · reported by MITREMedium 5.4
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
Affected
2.9 to 2.9
What to do
Affects 2.9 to 2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.51cto.com plugins.trac.wordpress.org
Sep 6, 2018The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.CVE-2018-16285 · WordPress plugins & themes · reported by MITREMedium 6.1
The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.
Product
UserPro
Affected
up to 4.9.23
What to do
Affects up to 4.9.23. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record risataim.blogspot.com wpvulndb.com
Aug 30, 2018The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template CVE-2018-16159 · WordPress plugins & themes · reported by MITRECritical 9.8
The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template request.
Product
Gift Vouchers
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Gift Vouchers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Jul 13, 2018The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, CVE-2016-6565 · WordPress plugins & themes · reported by cret@cert.orgHigh 7.5
The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).
Fixed in
2.1.57
What to do
Update the plugin to 2.1.57 or newer.
Full record and what to do →NVD record kb.cert.org securityfocus.com
Jun 26, 2018WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passeCVE-2018-12895 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.
Affected
up to 4.9.6
What to do
Affects up to 4.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 30, 2018Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter.CVE-2018-11568 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the '<' and '>' characters have < and > representations.
Product
Reflected XSS is possible in the GamePlan
Affected
up to 1.5.13.2
What to do
Affects up to 1.5.13.2. Update Reflected XSS is possible in the GamePlan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
May 28, 2018The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter.CVE-2018-11515 · WordPress plugins & themes · reported by MITRECritical 9.8
The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter.
Product
wpForo
Affected
up to 2018-02-05
What to do
Affects up to 2018-02-05. Update wpForo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Mar 25, 2018The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.CVE-2018-9020 · WordPress plugins & themes · reported by MITREMedium 5.4
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.
Product
Events Manager
Fixed in
5.8.1.2
What to do
Update Events Manager to 5.8.1.2 or newer.
Full record and what to do →NVD record wp-events-plugin.com wordpress.org
Mar 14, 2018the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter: Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL InjCVE-2018-1000131 · WordPress plugins & themes · reported by MITRECritical 9.8
Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later.
Product
the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter
Affected
up to 9.0.2
Fixed in
9.0.3
What to do
Update the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter to 9.0.3 or newer.
Full record and what to do →NVD record github.com wordpress.org
Jan 31, 2018The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.CVE-2018-6465 · WordPress plugins & themes · reported by MITREMedium 6.1
The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.
Product
PropertyHive
Fixed in
1.4.15
What to do
Update PropertyHive to 1.4.15 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Jan 27, 2018The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray paramCVE-2018-6357 · WordPress plugins & themes · reported by MITREHigh 8.8
The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.
Product
acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget
Fixed in
3.2.6
What to do
Update acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget to 3.2.6 or newer.
Full record and what to do →NVD record lists.openwall.net wordpress.org
Jan 22, 2018The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview paraCVE-2018-6001 · WordPress plugins & themes · reported by MITREMedium 6.1
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter).
Affected
up to 4.6
What to do
Affects up to 4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 16, 2018The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.CVE-2017-18032 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.
Product
download-manager
Fixed in
2.9.52
What to do
Update download-manager to 2.9.52 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Jan 13, 2018The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-adminCVE-2018-5695 · WordPress plugins & themes · reported by MITREHigh 7.2
The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php.
Affected
4.4.4 to 4.4.4
What to do
Affects 4.4.4 to 4.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Jan 12, 2018The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.CVE-2018-5315 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jan 12, 2018The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5374 · WordPress plugins & themes · reported by MITREHigh 8.8
The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
Product
Dbox 3D Slider Lite
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Dbox 3D Slider Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 12, 2018The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).CVE-2018-5373 · WordPress plugins & themes · reported by MITREHigh 8.8
The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).
Product
Smooth Slider
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Smooth Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 12, 2018The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5372 · WordPress plugins & themes · reported by MITREHigh 8.8
The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
Product
Testimonial Slider
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 12, 2018The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.CVE-2018-5369 · WordPress plugins & themes · reported by MITREMedium 4.8
The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.
Affected
1.46 to 1.46
What to do
Affects 1.46 to 1.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.CVE-2018-5367 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.CVE-2018-5366 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.CVE-2018-5365 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.CVE-2018-5364 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.CVE-2018-5362 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 9, 2018The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.CVE-2018-5316 · WordPress plugins & themes · reported by MITREMedium 6.1
The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.
Product
SagePay Server Gateway for WooCommerce
Fixed in
1.0.9
What to do
Update SagePay Server Gateway for WooCommerce to 1.0.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Jan 9, 2018The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.CVE-2018-5312 · WordPress plugins & themes · reported by MITREMedium 5.4
The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.
Affected
1.8.0 to 1.8.0
What to do
Affects 1.8.0 to 1.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 9, 2018The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt CVE-2018-5311 · WordPress plugins & themes · reported by MITREMedium 5.4
The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt URI.
Affected
2.4.6 to 2.4.6
What to do
Affects 2.4.6 to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 9, 2018In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-seaCVE-2018-5310 · WordPress plugins & themes · reported by MITREMedium 6.5
In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI.
Product
In the "Media from FTP
Fixed in
9.85
What to do
Update In the "Media from FTP to 9.85 or newer.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.CVE-2018-5293 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.CVE-2018-5292 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.CVE-2018-5291 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.CVE-2018-5290 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.CVE-2018-5289 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.CVE-2018-5288 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.CVE-2018-5287 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page.CVE-2018-5286 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.CVE-2018-5284 · WordPress plugins & themes · reported by MITREMedium 4.8
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
Affected
1.15 to 1.15
What to do
Affects 1.15 to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.