Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
35added in the last 30 days
472new WordPress flaws this week
390,714entries in the database

112 results · page 3 of 3

  • Sep 6, 2022Ultimate SMS Notifications for WooCommerce: CSV InjectionCVE-2022-2429 · WordPress plugins & themes · reported by WordfenceMedium 6.5

    The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

    Product
    Ultimate SMS Notifications for WooCommerce
    Affected
    up to 1.4.1
    What to do
    Affects up to 1.4.1. Update Ultimate SMS Notifications for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

  • Jun 27, 2022Login With OTP Over SMS, Email, WhatsApp and Google Authenticator: Does not escape its settingsCVE-2022-1994 · WordPress plugins & themes · reported by WPScanMedium 4.8

    The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

    Product
    Login With OTP Over SMS, Email, WhatsApp and Google Authenticator
    Fixed in
    1.0.8
    What to do
    Update Login With OTP Over SMS, Email, WhatsApp and Google Authenticator to 1.0.8 or newer.

    Full record and what to do →NVD recordwpscan.comwpscan.com

  • Sep 10, 2021SMS OVH: Reflected Cross-Site ScriptingCVE-2021-38357 · WordPress plugins & themes · reported by WordfenceMedium 6.1

    The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.

    Product
    SMS OVH
    Affected
    up to 0.1
    What to do
    Affects up to 0.1. Update SMS OVH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

  • Sep 6, 2021SMS Alert Order Notifications: Is affected by a cross site scripting (XSS) vulnerability in the plugin's setting pageCVE-2021-24588 · WordPress plugins & themes · reported by WPScanMedium 6.1

    The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's setting page.

    Product
    SMS Alert Order Notifications
    Fixed in
    3.4.7
    What to do
    Update SMS Alert Order Notifications to 3.4.7 or newer.

    Full record and what to do →NVD recordwpscan.comwpscan.com

  • Aug 23, 2021WP SMS: Does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" pageCVE-2021-24561 · WordPress plugins & themes · reported by WPScanMedium 5.4

    The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue

    Product
    WP SMS
    Fixed in
    5.4.13
    What to do
    Update WP SMS to 5.4.13 or newer.

    Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

  • Sep 17, 2019The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.CVE-2016-10987 · WordPress plugins & themes · reported by MITREMedium 6.1

    The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.

    Product
    persian-woocommerce-sms
    Fixed in
    3.3.4
    What to do
    Update persian-woocommerce-sms to 3.3.4 or newer.

    Full record and what to do →NVD record0x62626262.wordpress.comwordpress.org

  • Aug 21, 2019The booking-sms plugin before 1.1.0 for WordPress has XSS.CVE-2017-18555 · WordPress plugins & themes · reported by MITREMedium 6.1

    The booking-sms plugin before 1.1.0 for WordPress has XSS.

    Product
    booking-sms
    Fixed in
    1.1.0
    What to do
    Update booking-sms to 1.1.0 or newer.

    Full record and what to do →NVD recordwordpress.orgwordpress.org

  • Aug 13, 2019The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.CVE-2017-18495 · WordPress plugins & themes · reported by MITREMedium 6.1

    The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.

    Product
    gravity-forms-sms-notifications
    Fixed in
    2.4.0
    What to do
    Update gravity-forms-sms-notifications to 2.4.0 or newer.

    Full record and what to do →NVD recordwordpress.orgwordpress.org

  • Aug 13, 2019The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.CVE-2017-18489 · WordPress plugins & themes · reported by MITREMedium 6.1

    The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.

    Product
    contact-form-7-sms-addon
    Fixed in
    2.4.0
    What to do
    Update contact-form-7-sms-addon to 2.4.0 or newer.

    Full record and what to do →NVD recordwordpress.orgwordpress.org

  • Jan 1, 2018The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameCVE-2017-18010 · WordPress plugins & themes · reported by MITREMedium 6.1

    The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.

    Product
    E-goi Smart Marketing SMS and Newsletters Forms
    Fixed in
    2.0.0
    What to do
    Update E-goi Smart Marketing SMS and Newsletters Forms to 2.0.0 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

  • Dec 19, 2017The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php.CVE-2017-17780 · WordPress plugins & themes · reported by MITREMedium 6.1

    The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org

  • Sep 27, 2017Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.CVE-2017-14842 · WordPress plugins & themes · reported by MITREHigh 8.8

    Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordexploit-db.comexploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.