Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
110 results · page 3 of 3
Sep 9, 2019The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.CVE-2018-21012 · WordPress plugins & themes · reported by MITREMedium 6.1
The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.
- Product
- cf7-invisible-recaptcha
- Fixed in
- 1.3.2
- What to do
- Update cf7-invisible-recaptcha to 1.3.2 or newer.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Aug 22, 2019The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.CVE-2018-20988 · WordPress plugins & themes · reported by MITREHigh 7.5
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.
- Product
- wpgform
- Fixed in
- 0.94
- What to do
- Update wpgform to 0.94 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Feb 5, 2019The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values.CVE-2019-7412 · WordPress plugins & themes · reported by MITRECritical 9.8
The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values.
- Product
- PS PHPCaptcha WP
- Fixed in
- 1.2.0
- What to do
- Update PS PHPCaptcha WP to 1.2.0 or newer.
Full record and what to do →NVD recordmetamorfosec.comwordpress.org
Mar 3, 2015The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain adCVE-2015-0890 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
- Product
- BestWebSoft Google Captcha (aka reCAPTCHA)
- Fixed in
- 1.13
- What to do
- Update BestWebSoft Google Captcha (aka reCAPTCHA) to 1.13 or newer.
Mar 3, 2015The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access viCVE-2014-9283 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
- Product
- BestWebSoft Captcha
- Fixed in
- 4.0.7
- What to do
- Update BestWebSoft Captcha to 4.0.7 or newer.
Aug 7, 2014Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers toCVE-2014-5190 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
- Product
- SI CAPTCHA Anti-Spam
- What to do
- Update SI CAPTCHA Anti-Spam to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Mar 14, 2014Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcfCVE-2014-2265 · WordPress plugins & themes · reported by MITREMedium 5
Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter.
- Fixed in
- 3.7.2
- What to do
- Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD recordcontactform7.comweb.archive.org
Mar 22, 2011Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remoCVE-2011-0759 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting (XSS) sequences via the (1) recaptcha_opt_pubkey, (2) recaptcha_opt_privkey, (3) re_tabindex, (4) error_blank, (5) error_incorrect, (6) mailhide_pub, (7) mailhide_priv, (8) mh_replace_link, or (9) mh_replace_title parameter.
- Product
- Recaptcha (aka WP-reCAPTCHA)
- What to do
- Update Recaptcha (aka WP-reCAPTCHA) to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
Sep 11, 2009Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which aCVE-2008-7216 · WordPress plugins & themes · reported by MITREMedium 4.3
Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddocs.google.comsecurityfocus.com
Jan 9, 2008Multiple cross-site scripting (XSS) vulnerabilities in captcha\captcha.php in the Captcha! 2.5d and earlier plugin for WordPress allow remote attackers to injecCVE-2008-0206 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in captcha\captcha.php in the Captcha! 2.5d and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) captcha_ttffolder, (2) captcha_numchars, (3) captcha_ttfrange, or (4) captcha_secret parameter.
- Affected
- up to 2.5d
- What to do
- Affects up to 2.5d. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.grok.org.uksecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.