Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list
34added in the last 30 days
343new WordPress flaws this week
390,080entries in the database

121 results · page 3 of 3

  • Feb 9, 2021A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload.CVE-2020-35943 · WordPress plugins & themes · reported by MITREMedium 6.5

    A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)

    Product
    A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery
    Fixed in
    3.5.0
    What to do
    Update A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery to 3.5.0 or newer.

    Full record and what to do →NVD recordwordfence.comwordfence.com

  • Feb 9, 2021A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modiCVE-2020-35942 · WordPress plugins & themes · reported by MITREHigh 8.8

    A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)

    Product
    A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery
    Fixed in
    3.5.0
    What to do
    Update A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery to 3.5.0 or newer.

    Full record and what to do →NVD recordwordfence.comwordfence.com

  • Aug 16, 2020php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameCVE-2016-11085 · WordPress plugins & themes · reported by MITREMedium 6.5

    php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.

    Product
    php/qmn_options_questions_tab.php in the quiz-master-next
    Fixed in
    4.7.9
    What to do
    Update php/qmn_options_questions_tab.php in the quiz-master-next to 4.7.9 or newer.

    Full record and what to do →NVD recordsecurity.dxw.comsecurity.dxw.com

  • Feb 11, 2020NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file uploadCVE-2013-3684 · WordPress plugins & themes · reported by MITRECritical 9.8

    NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload

    Product
    NextGEN Gallery
    Fixed in
    1.9.13
    What to do
    Update NextGEN Gallery to 1.9.13 or newer.

    Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com

  • Jan 30, 2020NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure VulnerabilityCVE-2013-0291 · WordPress plugins & themes · reported by Red HatHigh 7.5

    NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordopenwall.comsecurityfocus.com

  • Dec 13, 2019The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS).CVE-2019-17599 · WordPress plugins & themes · reported by MITREMedium 6.1

    The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.

    Product
    quiz-master-next (aka Quiz And Survey Master)
    Fixed in
    6.3.5
    What to do
    Update quiz-master-next (aka Quiz And Survey Master) to 6.3.5 or newer.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Nov 26, 2019The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.CVE-2015-9538 · WordPress plugins & themes · reported by MITREMedium 6.5

    The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.

    Product
    NextGEN Gallery
    Fixed in
    2.1.15
    What to do
    Update NextGEN Gallery to 2.1.15 or newer.

    Full record and what to do →NVD recordcxsecurity.comcybersecurityworks.com

  • Nov 26, 2019The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, andCVE-2015-9537 · WordPress plugins & themes · reported by MITREMedium 5.4

    The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.

    Product
    NextGEN Gallery
    Fixed in
    2.1.10
    What to do
    Update NextGEN Gallery to 2.1.10 or newer.

    Full record and what to do →NVD recordcybersecurityworks.comgithub.com

  • Aug 27, 2019A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.CVE-2019-14314 · WordPress plugins & themes · reported by MITRECritical 9.8

    A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.

    Product
    A SQL injection vulnerability exists in the Imagely NextGEN Gallery
    Fixed in
    3.2.11
    What to do
    Update A SQL injection vulnerability exists in the Imagely NextGEN Gallery to 3.2.11 or newer.

    Full record and what to do →NVD recordde.wordpress.orgwordpress.org

  • Aug 14, 2019The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.CVE-2016-10889 · WordPress plugins & themes · reported by MITRECritical 9.8

    The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.

    Product
    nextgen-gallery
    Fixed in
    2.1.57
    What to do
    Update nextgen-gallery to 2.1.57 or newer.

    Full record and what to do →NVD recordwordpress.orgwordpress.org

  • Jul 13, 2018The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, CVE-2016-6565 · WordPress plugins & themes · reported by cret@cert.orgHigh 7.5

    The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).

    Fixed in
    2.1.57
    What to do
    Update the plugin to 2.1.57 or newer.

    Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com

  • Apr 30, 2018Image Alt & Title Text: Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS)CVE-2018-1000172 · WordPress plugins & themes · reported by MITREMedium 4.8

    Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45.

    Product
    Image Alt & Title Text
    Affected
    up to 2.2.30
    Fixed in
    2.2.45
    What to do
    Update Image Alt & Title Text to 2.2.45 or newer.

    Full record and what to do →NVD recordfortiguard.comwordpress.org

  • Apr 12, 2018Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5CVE-2015-4557 · WordPress plugins & themes · reported by MITREMedium 6.1

    Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413.

    Fixed in
    1.5.2
    What to do
    Update the plugin to 1.5.2 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comseclists.org

  • Mar 1, 2018In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.CVE-2018-7586 · WordPress plugins & themes · reported by MITREHigh 7.5

    In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.

    Product
    In the nextgen-gallery
    Fixed in
    2.2.50
    What to do
    Update In the nextgen-gallery to 2.2.50 or newer.

    Full record and what to do →NVD recordwordpress.orgwpvulndb.com

  • Sep 12, 2017In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via CVE-2015-9229 · WordPress plugins & themes · reported by MITREMedium 4.8

    In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.

    Product
    Photocrati NextGEN Gallery
    Affected
    2.1.15 to 2.1.15
    What to do
    Affects 2.1.15 to 2.1.15. Update Photocrati NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordcybersecurityworks.comgithub.com

  • Sep 12, 2017In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extensionCVE-2015-9228 · WordPress plugins & themes · reported by MITREHigh 8.8

    In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.

    Product
    Photocrati NextGEN Gallery
    What to do
    Update Photocrati NextGEN Gallery to the newest version.

    Full record and what to do →NVD recordopenwall.comcybersecurityworks.com

  • Jun 24, 2015Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for CVE-2015-4413 · WordPress plugins & themes · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.

    Fixed in
    1.5.6
    What to do
    Update the plugin to 1.5.6 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comseclists.org

  • Dec 5, 2014Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackCVE-2014-8800 · WordPress plugins & themes · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a newfb_update_options action.

    Product
    Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect
    Fixed in
    1.5.1
    What to do
    Update Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect to 1.5.1 or newer.

    Full record and what to do →NVD recordosvdb.orgsecurity.szurek.pl

  • May 8, 2014Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated uCVE-2014-3123 · WordPress plugins & themes · reported by MITRELow 2.1

    Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.

    Product
    Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery
    Fixed in
    1.19.18
    What to do
    Update Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery to 1.19.18 or newer.

    Full record and what to do →NVD recordsecunia.comsecurityfocus.com

  • Apr 7, 2010Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitraCVE-2010-1186 · WordPress plugins & themes · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

    Product
    Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery
    Fixed in
    1.5.2
    What to do
    Update Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery to 1.5.2 or newer.

    Full record and what to do →NVD recordsecunia.comwordpress.org

  • Sep 8, 2009wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for: Cross-site scripting (XSS)CVE-2008-7175 · WordPress plugins & themes · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.

    Product
    wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for
    Affected
    up to 0.96
    What to do
    Affects up to 0.96. Update wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordosvdb.orgsecurityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.