Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
145 results · page 3 of 3
Aug 23, 2022Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress.CVE-2022-33142 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress.
- Affected
- up to 1.9.10.57
- What to do
- Affects up to 1.9.10.57. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 8, 2022WordPress Comments Fields: Does not escape Field Error MessageCVE-2022-2398 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WordPress Comments Fields
- Fixed in
- 4.1
- What to do
- Update WordPress Comments Fields to 4.1 or newer.
Jul 20, 2022WordPlus Better Messages plugin <= 1.9.9.148 at: Cross-Site Request Forgery (CSRF)CVE-2022-29454 · WordPress plugins & themes · reported by PatchstackLow 3.1
Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated.
- Product
- WordPlus Better Messages plugin <= 1.9.9.148 at
- Affected
- up to 1.9.9.148
- What to do
- Affects up to 1.9.9.148. Update WordPlus Better Messages plugin <= 1.9.9.148 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 15, 2022Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For WordPress <= 2.1.10 at WordPress.CVE-2022-29442 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For WordPress <= 2.1.10 at WordPress.
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 15, 2022Private Messages For WordPress plugin <= 2.1.10 at: Cross-Site Request Forgery (CSRF)CVE-2022-29441 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin <= 2.1.10 at WordPress allows attackers to send messages.
- Product
- Private Messages For WordPress plugin <= 2.1.10 at
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update Private Messages For WordPress plugin <= 2.1.10 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_messCVE-2022-1425 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
Apr 18, 2022Thank Me Later: Does not sanitise and escape the Message Subject field before outputting it in the Messages listCVE-2022-1063 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Thank Me Later
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Thank Me Later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2022Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message.CVE-2022-27850 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message.
- Affected
- up to 20220115
- What to do
- Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 14, 2022Master Addons for Elementor: Does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX actionCVE-2022-0327 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting
- Product
- Master Addons for Elementor
- Fixed in
- 1.8.5
- What to do
- Update Master Addons for Elementor to 1.8.5 or newer.
Feb 14, 2022MapPress Maps for: Does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error messageCVE-2022-0208 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
- Product
- MapPress Maps for
- Fixed in
- 2.73.4
- What to do
- Update MapPress Maps for to 2.73.4 or newer.
Feb 7, 2022Store Toolkit for WooCommerce: Does not sanitise and escape the tab parameter before outputting it back in an admin page in an error messageCVE-2021-25077 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting
- Product
- Store Toolkit for WooCommerce
- Fixed in
- 2.3.2
- What to do
- Update Store Toolkit for WooCommerce to 2.3.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 21, 2021Popups, Welcome Bar, Optins and Lead Generation: Does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attributeCVE-2021-24941 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Popups, Welcome Bar, Optins and Lead Generation
- Fixed in
- 2.0.5
- What to do
- Update Popups, Welcome Bar, Optins and Lead Generation to 2.0.5 or newer.
Nov 1, 2021BP Better Messages: Does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chatCVE-2021-24809 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions
- Product
- BP Better Messages
- Fixed in
- 1.9.9.41
- What to do
- Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021BP Better Messages: Sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attributeCVE-2021-24808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- BP Better Messages
- Fixed in
- 1.9.9.41
- What to do
- Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021Content text slider on post: Does not sanitise and escape the Title and Message/Content settingsCVE-2015-20019 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues
- Product
- Content text slider on post
- Fixed in
- 6.9
- What to do
- Update Content text slider on post to 6.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgseclists.org
Oct 25, 2021Cookie Bar: Doesn't properly sanitise the Cookie Bar Message settingCVE-2021-24653 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Cookie Bar
- Fixed in
- 1.8.9
- What to do
- Update Cookie Bar to 1.8.9 or newer.
Oct 19, 2021WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.CVE-2021-36832 · WordPress plugins & themes · reported by PatchstackMedium 4.8
WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 11, 2021Comments – wpDiscuz: Does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the pageCVE-2021-24737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Comments – wpDiscuz
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not escape the message parameter before outputting it back in the admin dashboardCVE-2021-24632 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Recipe Card Blocks by WPZOOM
- Fixed in
- 2.8.1
- What to do
- Update Recipe Card Blocks by WPZOOM to 2.8.1 or newer.
Aug 30, 2021Business Hours Indicator: Does not sanitise or escape its 'Now closed message" settingCVE-2021-24593 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue
- Product
- Business Hours Indicator
- Fixed in
- 2.3.5
- What to do
- Update Business Hours Indicator to 2.3.5 or newer.
Aug 16, 2021Media Usage: Reflected Cross-Site ScriptingCVE-2021-34652 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.4.
- Product
- Media Usage
- Affected
- up to 0.0.4
- What to do
- Affects up to 0.0.4. Update Media Usage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 16, 2021Light Messages: Is lacking CSRF checkCVE-2021-24535 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin's settings), or both frontend and backend.
- Product
- Light Messages
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Light Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2021A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in thCVE-2020-26153 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
- Fixed in
- 4.10.7.p
- What to do
- Update the plugin to 4.10.7.p or newer.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
May 6, 2021The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX aCVE-2021-24246 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues
- Product
- Workscout Core
- Fixed in
- 1.3.4
- What to do
- Update Workscout Core to 1.3.4 or newer.
Apr 22, 2021Advanced Booking Calendar: Does not sanitise the license error messageCVE-2021-24232 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue
- Product
- Advanced Booking Calendar
- Fixed in
- 1.6.8
- What to do
- Update Advanced Booking Calendar to 1.6.8 or newer.
Nov 12, 2020Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which: An unauthenticated SQL InjectionCVE-2020-27481 · WordPress plugins & themes · reported by MITRECritical 9.8
An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization.
- Product
- Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jan 21, 2020The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.CVE-2020-7239 · WordPress plugins & themes · reported by MITREMedium 6.1
The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.
- Product
- conversation-watson
- Fixed in
- 0.8.21
- What to do
- Update conversation-watson to 0.8.21 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jan 13, 2020The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message CVE-2019-20212 · WordPress plugins & themes · reported by MITREMedium 6.1
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.
- Fixed in
- 2.3.4
- What to do
- Update the plugin to 2.3.4 or newer.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Oct 10, 2019The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.CVE-2015-9477 · WordPress plugins & themes · reported by MITREHigh 8.8
The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.
- Affected
- 1.2.8 to 1.2.8
- What to do
- Affects 1.2.8 to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Sep 17, 2019The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or CVE-2016-10988 · WordPress plugins & themes · reported by MITREMedium 6.1
The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.
- Product
- leenkme
- Fixed in
- 2.6.0
- What to do
- Update leenkme to 2.6.0 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.CVE-2015-9317 · WordPress plugins & themes · reported by MITREMedium 6.1
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
- Product
- awesome-support
- Fixed in
- 3.1.7
- What to do
- Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Feb 17, 2019The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.CVE-2018-20782 · WordPress plugins & themes · reported by MITREHigh 7.5
The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
- Product
- GloBee
- Fixed in
- 1.1.2
- What to do
- Update GloBee to 1.1.2 or newer.
Jan 9, 2019The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameCVE-2016-10736 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.
- Product
- Social Pug - Easy Social Share Buttons
- Fixed in
- 1.2.6
- What to do
- Update Social Pug - Easy Social Share Buttons to 1.2.6 or newer.
Full record and what to do →NVD recordadvisories.dxw.comadvisories.dxw.com
Oct 3, 2018The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.CVE-2018-17946 · WordPress plugins & themes · reported by MITREMedium 6.1
The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.
- Product
- Tribulant Slideshow Gallery
- Fixed in
- 1.6.6.1
- What to do
- Update Tribulant Slideshow Gallery to 1.6.6.1 or newer.
Full record and what to do →NVD recorddefensecode.comwordpress.org
Jan 9, 2018The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.CVE-2018-5316 · WordPress plugins & themes · reported by MITREMedium 6.1
The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.
- Product
- SagePay Server Gateway for WooCommerce
- Fixed in
- 1.0.9
- What to do
- Update SagePay Server Gateway for WooCommerce to 1.0.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Dec 27, 2017Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.CVE-2015-7666 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.
- Fixed in
- 1.0.2
- What to do
- Update the plugin to 1.0.2 or newer.
Full record and what to do →NVD recordsecurityfocus.complugins.trac.wordpress.org
Dec 19, 2017The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php.CVE-2017-17780 · WordPress plugins & themes · reported by MITREMedium 6.1
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
May 18, 2017In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not propCVE-2017-9061 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
- Fixed in
- 4.7.5
- What to do
- Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
May 4, 2017WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwoCVE-2017-8295 · WordPress plugins & themes · reported by MITREMedium 5.9
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.
- Affected
- up to 4.7.4
- What to do
- Affects up to 4.7.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Sep 2, 2015Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script CVE-2015-6805 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message.
- Product
- MDC Private Message
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update MDC Private Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comexploit-db.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPresCVE-2014-4549 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.
- Fixed in
- 0.1.6.7
- What to do
- Update the plugin to 0.1.6.7 or newer.
Full record and what to do →NVD recordcodevigilant.comwordpress.org
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allCVE-2014-4583 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) order_direction, (3) limit_start, (4) id, or (5) order parameter.
- Product
- WP-Contact (wp-contact-sidebar-widget)
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP-Contact (wp-contact-sidebar-widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameteCVE-2011-4898 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com
Jan 8, 2007wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive informaCVE-2007-0109 · WordPress plugins & themes · reported by MITREMedium 5
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 5, 2005wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, wCVE-2005-2109 · WordPress plugins & themes · reported by MITREMedium 5
wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.
- Affected
- up to 1.5.1.2
- What to do
- Affects up to 1.5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.