Vulnerability database

124 results · page 3 of 3

• Apr 15, 2021Wordpress is an open source CMS.CVE-2021-29450 · WordPress plugins & themes · reported by GitHubMedium 6.5

  Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordgithub.comlists.debian.org

• Apr 15, 2021Wordpress is an open source CMS.CVE-2021-29447 · WordPress plugins & themes · reported by GitHubHigh 7.1

  Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Oct 21, 2020The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.CVE-2020-27344 · WordPress plugins & themes · reported by MITREMedium 6.1

  The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.

  Product

  cm-download-manager

  Fixed in

  2.8.0

  What to do

  Update cm-download-manager to 2.8.0 or newer.

  Full record and what to do →NVD recordgist.github.comwordpress.org

• Mar 14, 2020The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison.CVE-2020-10568 · WordPress plugins & themes · reported by MITREHigh 8.8

  The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.

  Product

  sitepress-multilingual-cms (WPML)

  Fixed in

  4.3.7-b.2

  What to do

  Update sitepress-multilingual-cms (WPML) to 4.3.7-b.2 or newer.

  Full record and what to do →NVD recordmedium.comwpvulndb.com

• Sep 25, 2019The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.CVE-2015-9416 · WordPress plugins & themes · reported by MITREMedium 6.1

  The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.

  Affected

  2.9.3 to 3.2.6

  What to do

  Affects 2.9.3 to 3.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwpvulndb.com

• Aug 29, 2019cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such CVE-2019-14979 · WordPress plugins & themes · reported by MITREMedium 5.3

  cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state

  Product

  WooCommerce PayPal Checkout Payment Gateway

  Affected

  1.6.17 to 1.6.17

  What to do

  Affects 1.6.17 to 1.6.17. Update WooCommerce PayPal Checkout Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgkaim.comwordpress.org

• Aug 15, 2019The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.CVE-2019-14786 · WordPress plugins & themes · reported by MITREMedium 6.5

  The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.

  Fixed in

  1.0.27.1

  What to do

  Update the plugin to 1.0.27.1 or newer.

  Full record and what to do →NVD recordrankmath.comwpvulndb.com

• May 6, 2019The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_defaulCVE-2019-11807 · WordPress plugins & themes · reported by MITREHigh 7.5

  The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_default_keys_load parameter because of a nopriv_ registration and a lack of capabilities checks.

  Product

  WooCommerce Checkout Manager

  Fixed in

  4.3

  What to do

  Update WooCommerce Checkout Manager to 4.3 or newer.

  Full record and what to do →NVD recordwpvulndb.comwordfence.com

• Mar 21, 2019cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such aCVE-2019-7441 · WordPress plugins & themes · reported by MITREMedium 6.5

  cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state

  Product

  WooCommerce PayPal Checkout Payment Gateway

  Affected

  1.6.8 to 1.6.8

  What to do

  Affects 1.6.8 to 1.6.8. Update WooCommerce PayPal Checkout Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comgkaim.com

• Oct 8, 2018process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_nCVE-2018-18069 · WordPress plugins & themes · reported by MITREMedium 6.1

  process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.

  Product

  process_forms in the WPML (aka sitepress-multilingual-cms)

  Affected

  up to 3.6.3

  What to do

  Affects up to 3.6.3. Update process_forms in the WPML (aka sitepress-multilingual-cms) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD record0x62626262.wordpress.com0x62626262.wordpress.com

• Apr 10, 2018The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd paCVE-2014-3114 · WordPress plugins & themes · reported by MITRECritical 9.8

  The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php.

  Affected

  up to 12.03.10

  What to do

  Affects up to 12.03.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordopenwall.comopenwall.com

• Sep 14, 2017Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invediCVE-2017-1002003 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

  Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

  Affected

  1.1.4 to 1.1.4

  What to do

  Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com

• Sep 14, 2017Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/CVE-2017-1002002 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

  Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

  Affected

  2.0 to 2.0

  What to do

  Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com

• Sep 14, 2017Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.CVE-2017-1002001 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

  Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

  Affected

  1.05 to 1.05

  What to do

  Affects 1.05 to 1.05. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvapidlabs.comwordpress.org

• Dec 5, 2014The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remCVE-2014-8877 · WordPress plugins & themes · reported by MITREHigh 10

  The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.

  Product

  alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager

  Fixed in

  2.0.4

  What to do

  Update alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager to 2.0.4 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comitas.vn

• Dec 5, 2014Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack thCVE-2014-9129 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the addons_title parameter in the CMDM_admin_settings page to wp-admin/admin.php.

  Product

  Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager

  Fixed in

  2.0.7

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager to 2.0.7 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

• Jul 1, 2014Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inCVE-2014-4516 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the param parameter.

  Product

  BIC Media Widget

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update BIC Media Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• Apr 7, 2014Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows CVE-2012-1834 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php.

  Product

  Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View

  Fixed in

  0.8.9

  What to do

  Update Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View to 0.8.9 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Oct 24, 2012Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to injecCVE-2012-5388 · WordPress plugins & themes · reported by MITRELow 3.5

  Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.

  Product

  White Label CMS

  What to do

  Update White Label CMS to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgwordpress.org

• Oct 24, 2012Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack tCVE-2012-5387 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, as demonstrated by a developer name containing XSS sequences.

  Product

  Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS

  Fixed in

  1.5.1

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS to 1.5.1 or newer.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Jul 20, 2007index.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2007-3939 · WordPress plugins & themes · reported by MITREMedium 6.8

  SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter.

  Product

  index.php in SpoonLabs Vivvo Article Management CMS

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update index.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgsecurityfocus.com

• Jan 30, 2007rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2007-0574 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.40 allows remote attackers to execute arbitrary SQL commands via the wcHeadlines parameter, a different vector than CVE-2006-4715. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

  Product

  rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS

  What to do

  Update rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecurityfocus.com

• Sep 12, 2006index.php in SpoonLabs Vivvo Article Management CMS: PHP remote file inclusionCVE-2006-4714 · WordPress plugins & themes · reported by MITREMedium 5.1

  PHP remote file inclusion vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the classified_path parameter.

  Product

  index.php in SpoonLabs Vivvo Article Management CMS

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update index.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecunia.comsecuritydot.net

• Sep 12, 2006pdf_version.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2006-4715 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  Product

  pdf_version.php in SpoonLabs Vivvo Article Management CMS

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update pdf_version.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecunia.comsecuritydot.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.