Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

175 results · page 3 of 4

Jun 3, 2024Spectra: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-23735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affects Spectra: from n/a through 2.3.0.
Product
Spectra
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Car Dealer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSSCVE-2024-4214 · WordPress plugins & themes · reported by PatchstackLow 2.7
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Bill Minozzi Car Dealer allows Code Injection.This issue affects Car Dealer: from n/a through 4.15.
Product
Car Dealer
Affected
up to 4.15
What to do
Affects up to 4.15. Update Car Dealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Pricing Table by Supsystic: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-32790 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Supsystic Pricing Table by Supsystic allows Code Injection.This issue affects Pricing Table by Supsystic: from n/a through 1.9.12.
Product
Pricing Table by Supsystic
Affected
up to 1.9.12
What to do
Affects up to 1.9.12. Update Pricing Table by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024CP Polls: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-24874 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CodePeople CP Polls allows Code Injection.This issue affects CP Polls: from n/a through 1.0.71.
Product
CP Polls
Affected
up to 1.0.71
What to do
Affects up to 1.0.71. Update CP Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Formidable Forms: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-23522 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Injection.This issue affects Formidable Forms: from n/a through 6.7.
Product
Formidable Forms
Affected
up to 6.7
What to do
Affects up to 6.7. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Carousel Slider: Does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embedCVE-2024-3703 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
Product
Carousel Slider
Fixed in
2.2.10
What to do
Update Carousel Slider to 2.2.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2024JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSSCVE-2023-48763 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.1.4.
Product
JetFormBuilder
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Related Posts for: Cross-Site Request Forgery (CSRF)CVE-2024-32549 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Microkid Related Posts for WordPress allows Cross-Site Scripting (XSS).This issue affects Related Posts for WordPress: from n/a through 4.0.3.
Product
Related Posts for
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Related Posts for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Inline Related Posts: Cross-Site Request Forgery (CSRF)CVE-2024-31426 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Data443 Inline Related Posts.This issue affects Inline Related Posts: from n/a through 3.3.1.
Product
Inline Related Posts
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Inline Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Inline Related Posts: Is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayedCVE-2023-6257 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts
Product
Inline Related Posts
Fixed in
3.6.0
What to do
Update Inline Related Posts to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 6, 2024Inline Related Posts: Does not sanitise and escape some of its settingsCVE-2024-2444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Inline Related Posts
Fixed in
3.5.0
What to do
Update Inline Related Posts to 3.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2024Responsive Pricing Table: Does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embedCVE-2024-1333 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Pricing Table
Fixed in
5.1.11
What to do
Update Responsive Pricing Table to 5.1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2024Related Posts for: Cross-Site Request ForgeryCVE-2024-0592 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the handle_create_link() function. This makes it possible for unauthenticated attackers to add related posts to other posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This ultimately makes it possible for attackers to view draft and password protected posts.
Product
Related Posts for
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Related Posts for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024YARPP – Yet Another Related Posts: Stored Cross-Site ScriptingCVE-2024-0602 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
YARPP – Yet Another Related Posts
Affected
up to 5.30.9
What to do
Affects up to 5.30.9. Update YARPP – Yet Another Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Feb 1, 2024Related Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51666 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue affects Related Post: from n/a through 2.0.53.
Product
Related Post
Affected
up to 2.0.53
What to do
Affects up to 2.0.53. Update Related Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Related Products for WooCommerce: Stored Cross-Site ScriptingCVE-2023-5234 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Related Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'woo-related' shortcode in versions up to, and including, 3.3.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Related Products for WooCommerce
Affected
up to 3.3.15
What to do
Affects up to 3.3.15. Update Related Products for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 6, 2023Resume Builder: Does not sanitize and escape some parameters related to ResumeCVE-2023-0078 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users
Product
Resume Builder
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Resume Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Contextual Related Posts: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0252 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Contextual Related Posts
Fixed in
3.3.1
What to do
Update Contextual Related Posts to 3.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022Professional Social Sharing Buttons, Icons & Related Posts: Does not have proper authorisation check in one of the AJAX actionCVE-2022-0594 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
Product
Professional Social Sharing Buttons, Icons & Related Posts
Fixed in
9.7.6
What to do
Update Professional Social Sharing Buttons, Icons & Related Posts to 9.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022WP User Manager: Does not ensure that the user ID to reset the password of is related to the reset key givenCVE-2021-24655 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account.
Product
WP User Manager
Fixed in
2.6.3
What to do
Update WP User Manager to 2.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts.CVE-2011-1762 · WordPress plugins & themes · reported by Red HatMedium 6.5
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 11, 2022Portfolio Gallery, Product Catalog: Does not have authorisation and CSRF checks in various functions related to AJAX actionsCVE-2021-25090 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
Product
Portfolio Gallery, Product Catalog
Fixed in
2.1.0
What to do
Update Portfolio Gallery, Product Catalog to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022OSMapper: Contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefixCVE-2021-24978 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete is a map one. As a result, unauthenticated user can delete arbitrary posts from the blog
Product
OSMapper
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update OSMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
Product
Contact Form Submissions
Fixed in
1.7.3
What to do
Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not sanitise and escape logged requests before outputting them in the related admin dashboardCVE-2021-24975 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
Product
NextScripts: Social Networks Auto-Poster
Fixed in
4.3.24
What to do
Update NextScripts: Social Networks Auto-Poster to 4.3.24 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022Speed Booster Pack ⚡ PageSpeed Optimization Suite: Does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related tableCVE-2021-25023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection
Product
Speed Booster Pack ⚡ PageSpeed Optimization Suite
Fixed in
4.3.3.1
What to do
Update Speed Booster Pack ⚡ PageSpeed Optimization Suite to 4.3.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021edit functionality in the MicroCopy: Makes a get request to fetch the related optionCVE-2021-24397 · WordPress plugins & themes · reported by WPScanHigh 7.2
The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
edit functionality in the MicroCopy
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update edit functionality in the MicroCopy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jul 19, 2021Related Posts for: Does not sanitise its heading_text and CSS settingsCVE-2021-24482 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payloads in them, leading to Stored Cross-Site Scripting issues.
Product
Related Posts for
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Related Posts for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru wpscan.com
Apr 5, 2021The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page.CVE-2021-24211 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.
Product
WordPress Related Posts
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update WordPress Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerabCVE-2021-24180 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.
Fixed in
2.0.4
What to do
Update the plugin to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 21, 2020The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.CVE-2020-27615 · WordPress plugins & themes · reported by MITRECritical 9.8
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
Product
Loginizer
Fixed in
1.6.4
What to do
Update Loginizer to 1.6.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpdeeply.com
May 29, 2020The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/CVE-2020-12675 · WordPress plugins & themes · reported by MITREHigh 8.8
The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.
Product
mappress-google-maps-for-wordpress
Fixed in
2.54.6
What to do
Update mappress-google-maps-for-wordpress to 2.54.6 or newer.
Full record and what to do →NVD record blog.alertlogic.com wordpress.org
Nov 11, 2019A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributCVE-2019-18855 · WordPress plugins & themes · reported by MITREHigh 7.5
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes.
Product
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG)
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com plugins.trac.wordpress.org
Nov 11, 2019A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ...CVE-2019-18854 · WordPress plugins & themes · reported by MITREHigh 7.5
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring.
Product
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG)
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com plugins.trac.wordpress.org
Aug 28, 2019The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9361 · WordPress plugins & themes · reported by MITREMedium 6.1
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Related Posts
Fixed in
1.8.2
What to do
Update Related Posts to 1.8.2 or newer.
Full record and what to do →NVD record blog.sucuri.net barrykooij.com
Aug 22, 2019The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.CVE-2017-18571 · WordPress plugins & themes · reported by MITRECritical 9.8
The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.
Product
search-everything
Fixed in
8.1.7
What to do
Update search-everything to 8.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.CVE-2016-10917 · WordPress plugins & themes · reported by MITRECritical 9.8
The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
Product
search-everything
Fixed in
8.1.6
What to do
Update search-everything to 8.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.CVE-2015-9320 · WordPress plugins & themes · reported by MITREMedium 6.1
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
Product
option-tree
Fixed in
2.5.4
What to do
Update option-tree to 2.5.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-15238 · WordPress plugins & themes · reported by MITREHigh 8.8
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
Product
cforms2
Fixed in
15.0.2
What to do
Update cforms2 to 15.0.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.CVE-2019-15116 · WordPress plugins & themes · reported by MITREMedium 6.1
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
Product
easy-digital-downloads
Fixed in
2.9.16
What to do
Update easy-digital-downloads to 2.9.16 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.CVE-2015-9314 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
Product
newstatpress
Fixed in
1.0.4
What to do
Update newstatpress to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.CVE-2015-9313 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Product
newstatpress
Fixed in
1.0.5
What to do
Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.CVE-2015-9312 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Product
newstatpress
Fixed in
1.0.5
What to do
Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.CVE-2015-9296 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Product
download-monitor
Fixed in
1.7.1
What to do
Update download-monitor to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.CVE-2019-14946 · WordPress plugins & themes · reported by MITREMedium 5.4
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
Product
ultimate-member
Fixed in
2.0.52
What to do
Update ultimate-member to 2.0.52 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.CVE-2015-9305 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
Product
wp-google-map-plugin
Fixed in
2.3.7
What to do
Update wp-google-map-plugin to 2.3.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 5, 2019Related YouTube Videos versions prior to 1.9.9: Cross-site request forgery (CSRF)CVE-2019-5980 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Related YouTube Videos versions prior to 1.9.9
Fixed in
1.9.9
What to do
Update Related YouTube Videos versions prior to 1.9.9 to 1.9.9 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 9, 2019The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (itCVE-2019-11869 · WordPress plugins & themes · reported by MITREMedium 6.1
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.
Affected
5.12.94 to 5.12.94
What to do
Affects 5.12.94 to 5.12.94. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Mar 10, 2019The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition areCVE-2019-9646 · WordPress plugins & themes · reported by MITREMedium 6.1
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."
Product
Contact Form Email
Fixed in
1.2.66
What to do
Update Contact Form Email to 1.2.66 or newer.
Full record and what to do →NVD record lists.openwall.net security-consulting.icu

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.