Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

143 results · page 3 of 3

Jun 1, 2018An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress.CVE-2018-11486 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CSS textarea field, which will be loaded on every site page.
Product
MULTIDOTS Advance Search for WooCommerce
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update MULTIDOTS Advance Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com labs.threatpress.com
May 31, 2018An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress.CVE-2018-11633 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities.
Product
MULTIDOTS Woo Checkout for Digital Goods
Affected
2.1 to 2.1
What to do
Affects 2.1 to 2.1. Update MULTIDOTS Woo Checkout for Digital Goods to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com wordpress.org
May 31, 2018An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress.CVE-2018-11632 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings via wp-admin/admin-post.php CSRF. There's no nonce or capability check in the whatsapp_share_setting_add_update() function.
Product
MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com wordpress.org
May 30, 2018An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress.CVE-2018-11580 · WordPress plugins & themes · reported by MITREMedium 5.4
An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.
Product
MULTIDOTS Mass Pages/Posts Creator
Affected
1.2.2 to 1.2.2
What to do
Affects 1.2.2 to 1.2.2. Update MULTIDOTS Mass Pages/Posts Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com wordpress.org
May 1, 2018An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress.CVE-2018-10371 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser via a page title.
Product
wunderfarm WF Cookie Consent
Affected
1.1.3 to 1.1.3
What to do
Affects 1.1.3 to 1.1.3. Update wunderfarm WF Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordpress.org
Apr 4, 2018An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress.CVE-2018-8719 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information.
Product
WP Security Audit Log
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update WP Security Audit Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Mar 14, 2018A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode paCVE-2018-8711 · WordPress plugins & themes · reported by MITRECritical 9.8
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.
Product
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF)
Fixed in
2.2.0
What to do
Update A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD record sec-consult.com wordpress.org
Mar 14, 2018A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode pCVE-2018-8710 · WordPress plugins & themes · reported by MITRECritical 9.8
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.
Product
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF)
Fixed in
2.2.0
What to do
Update A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD record sec-consult.com wordpress.org
Jan 26, 2018An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress.CVE-2018-6015 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data.
Product
An issue was discovered in the "Email Subscribers & Newsletters
Fixed in
3.4.8
What to do
Update An issue was discovered in the "Email Subscribers & Newsletters to 3.4.8 or newer.
Full record and what to do →NVD record blog.threatpress.com wordpress.org
Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5673 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.
Product
booking-calendar
Affected
2.1.7 to 2.1.7
What to do
Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5672 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.
Product
booking-calendar
Affected
2.1.7 to 2.1.7
What to do
Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5671 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.
Product
booking-calendar
Affected
2.1.7 to 2.1.7
What to do
Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5670 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.
Product
booking-calendar
Affected
2.1.7 to 2.1.7
What to do
Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the read-and-understood plugin 2.1 for WordPress.CVE-2018-5669 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php.
Product
read-and-understood
Affected
2.1 to 2.1
What to do
Affects 2.1 to 2.1. Update read-and-understood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the read-and-understood plugin 2.1 for WordPress.CVE-2018-5668 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_title parameter.
Product
read-and-understood
Affected
2.1 to 2.1
What to do
Affects 2.1 to 2.1. Update read-and-understood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the read-and-understood plugin 2.1 for WordPress.CVE-2018-5667 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_pattern parameter.
Product
read-and-understood
Affected
2.1 to 2.1
What to do
Affects 2.1 to 2.1. Update read-and-understood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5666 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5665 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5664 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5663 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_link parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5662 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5661 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5660 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_sub_title parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5659 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_title parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5658 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5657 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_icon parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5656 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5655 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5654 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREE_Access_Token parameter.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5653 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizar_pffree_settings_save_get-users parameter.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the dark-mode plugin 1.6 for WordPress.CVE-2018-5652 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter.
Product
dark-mode
Affected
1.6 to 1.6
What to do
Affects 1.6 to 1.6. Update dark-mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the dark-mode plugin 1.6 for WordPress.CVE-2018-5651 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_start parameter.
Product
dark-mode
Affected
1.6 to 1.6
What to do
Affects 1.6 to 1.6. Update dark-mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Dec 18, 2017An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress.CVE-2017-16949 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and file-uploader/file-uploader-class.php. This allows the attacker to upload anything they want to the server, as demonstrated by an action=ap_file_upload_action&allowedExtensions[]=php request to /wp-admin/admin-ajax.php that results in a .php file upload and resultant PHP code execution.
Product
An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Oct 16, 2017Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress.CVE-2017-15375 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules. Remote attackers are able to inject malicious script code to hijack admin session credentials via the backend, or to manipulate the backend on client-side performed requests. The attack vector is non-persistent and the request method to inject is GET. The attacker does not need a privileged user account to perform a successful exploitation.
Affected
4.5.1 to 4.5.1
What to do
Affects 4.5.1 to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.CVE-2017-14724 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 17, 2017An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress.CVE-2017-6955 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack.
Product
An issue was discovered in by-email/by-email.php in the Invite Anyone
Fixed in
1.3.15
What to do
Update An issue was discovered in by-email/by-email.php in the Invite Anyone to 1.3.15 or newer.
Full record and what to do →NVD record securityfocus.com github.com
Mar 17, 2017An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress.CVE-2017-6954 · WordPress plugins & themes · reported by MITREMedium 4.3
An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.
Product
An issue was discovered in includes/component.php in the BuddyPress Docs
Fixed in
1.9.3
What to do
Update An issue was discovered in includes/component.php in the BuddyPress Docs to 1.9.3 or newer.
Full record and what to do →NVD record securityfocus.com github.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6098 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication to Wordpress admin) with the POST Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6097 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authentication to Wordpress admin) with the POST Parameter: camp_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6096 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires authentication to Wordpress admin) with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6095 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with the GET Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 10, 2017An issue was discovered in the WP Mail plugin before 1.2 for WordPress.CVE-2017-5942 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allow you to execute JavaScript in the context of the user receiving the mail.
Product
An issue was discovered in the WP Mail
Fixed in
1.2
What to do
Update An issue was discovered in the WP Mail to 1.2 or newer.
Full record and what to do →NVD record securityfocus.com cjc.im
Dec 27, 2012WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discoverCVE-2012-5868 · WordPress plugins & themes · reported by MITRELow 2.6
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record whiteoaksecurity.com whiteoaksecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.