Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
119 results · page 3 of 3
Jul 30, 2022The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature.CVE-2022-33994 · WordPress plugins & themes · reported by MITRELow 3
The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators.
- Product
- Gutenberg
- Affected
- up to 13.7.3
- What to do
- Affects up to 13.7.3. Update Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jitendrapatro.mepatchstack.com
Jul 25, 2022SP Project & Document Manager: Uses an easily guessable path to store user filesCVE-2022-1551 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.
- Product
- SP Project & Document Manager
- Fixed in
- 4.58
- What to do
- Update SP Project & Document Manager to 4.58 or newer.
May 2, 2022Documentor: Fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executedCVE-2022-0773 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.
- Product
- Documentor
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Documentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022SP Project & Document Manager: Allows any authenticated usersCVE-2021-4225 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.
- Product
- SP Project & Document Manager
- Fixed in
- 4.24
- What to do
- Update SP Project & Document Manager to 4.24 or newer.
Feb 1, 2022Document Embedder: Contains a AJAX action endpointCVE-2021-24868 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.
- Product
- Document Embedder
- Fixed in
- 1.7.9
- What to do
- Update Document Embedder to 1.7.9 or newer.
Feb 1, 2022Document Embedder: Contains a REST endpointCVE-2021-24775 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts.
- Product
- Document Embedder
- Fixed in
- 1.7.5
- What to do
- Update Document Embedder to 1.7.5 or newer.
Aug 16, 2021SP Project & Document Manager: Attribute-based Reflected Cross-Site ScriptingCVE-2021-38315 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25.
- Product
- SP Project & Document Manager
- Affected
- up to 4.25
- What to do
- Affects up to 4.25. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 14, 2021SP Project & Document Manager: Allows users to upload filesCVE-2021-24347 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
- Product
- SP Project & Document Manager
- Fixed in
- 4.22
- What to do
- Update SP Project & Document Manager to 4.22 or newer.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 4, 2019The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.CVE-2019-19589 · WordPress plugins & themes · reported by MITRECritical 9.8
The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerability reported in PDF Embedder Plugin is not valid as the plugin itself doesn't control or manage the file upload process. It only serves the uploaded PDF files and the responsibility of uploading PDF file remains with the Site owner of Wordpress installation, the upload of PDF file is managed by Wordpress core and not by PDF Embedder Plugin. Control & block of polyglot file is required to be taken care at the time of upload, not on showing the file. Moreover, the reference mentions retrieving the files from the browser cache and manually renaming it to jar for executing the file. That refers to a two step non-connected steps which has nothing to do with PDF Embedder.
- Affected
- 4.4 to 4.4
- What to do
- Affects 4.4 to 4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsejalivre.orgwordpress.org
Sep 10, 2019The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.CVE-2017-18598 · WordPress plugins & themes · reported by MITREMedium 6.1
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
- Product
- Qards
- Affected
- up to 2017-10-11
- What to do
- Affects up to 2017-10-11. Update Qards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.CVE-2014-10385 · WordPress plugins & themes · reported by MITREMedium 6.1
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
- Product
- memphis-documents-library
- Fixed in
- 3.0
- What to do
- Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.CVE-2014-10384 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.
- Product
- memphis-documents-library
- Fixed in
- 3.0
- What to do
- Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.CVE-2014-10383 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.
- Product
- memphis-documents-library
- Fixed in
- 3.0
- What to do
- Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.CVE-2016-10882 · WordPress plugins & themes · reported by MITREHigh 8.8
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
- Product
- google-document-embedder
- Fixed in
- 2.6.2
- What to do
- Update google-document-embedder to 2.6.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The google-document-embedder plugin before 2.6.2 for WordPress has XSS.CVE-2016-10881 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
- Product
- google-document-embedder
- Fixed in
- 2.6.2
- What to do
- Update google-document-embedder to 2.6.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The google-document-embedder plugin before 2.6.1 for WordPress has XSS.CVE-2016-10880 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
- Product
- google-document-embedder
- Fixed in
- 2.6.1
- What to do
- Update google-document-embedder to 2.6.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Sep 1, 2015Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitraCVE-2015-2807 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
- Product
- Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud
- Fixed in
- 0.1.1
- What to do
- Update Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud to 0.1.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 2, 2014Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 aCVE-2014-9178 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Aug 10, 2011WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, whicCVE-2011-3127 · WordPress plugins & themes · reported by MITREMedium 5.8
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
- Fixed in
- 3.1.3
- What to do
- Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.