Vulnerability database

1,507 results · page 30 of 31

• Jan 4, 2018The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.CVE-2018-5214 · WordPress plugins & themes · reported by MITREMedium 5.4

  The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.

  Product

  Add Link to Facebook

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Add Link to Facebook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwordpress.org

• Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.phCVE-2018-5213 · WordPress plugins & themes · reported by MITREMedium 5.4

  The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.

  Product

  Simple Download Monitor

  Fixed in

  3.5.4

  What to do

  Update Simple Download Monitor to 3.5.4 or newer.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/CVE-2018-5212 · WordPress plugins & themes · reported by MITREMedium 5.4

  The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.

  Product

  Simple Download Monitor

  Fixed in

  3.5.4

  What to do

  Update Simple Download Monitor to 3.5.4 or newer.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jan 2, 2018Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker controlCVE-2017-1000434 · WordPress plugins & themes · reported by MITREMedium 6.1

  Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker controlled page classes/Furigana.php: header('location:'.urldecode($_GET['furikake-redirect']));

  Affected

  0.1.0 to 0.1.0

  What to do

  Affects 0.1.0 to 0.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcjc.imwpvulndb.com

• Jan 1, 2018The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter.CVE-2017-18015 · WordPress plugins & themes · reported by MITREMedium 6.1

  The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter.

  Product

  ILLID Share This Image

  Fixed in

  1.04

  What to do

  Update ILLID Share This Image to 1.04 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Jan 1, 2018The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.CVE-2017-18012 · WordPress plugins & themes · reported by MITREMedium 6.1

  The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.

  Affected

  1.6.1 to 1.6.1

  What to do

  Affects 1.6.1 to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.complugins.svn.wordpress.org

• Jan 1, 2018The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter.CVE-2017-18011 · WordPress plugins & themes · reported by MITREMedium 6.1

  The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter.

  Product

  MyCBGenie Affiliate Ads for Clickbank Products

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update MyCBGenie Affiliate Ads for Clickbank Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Jan 1, 2018The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameCVE-2017-18010 · WordPress plugins & themes · reported by MITREMedium 6.1

  The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.

  Product

  E-goi Smart Marketing SMS and Newsletters Forms

  Fixed in

  2.0.0

  What to do

  Update E-goi Smart Marketing SMS and Newsletters Forms to 2.0.0 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Dec 27, 2017The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter.CVE-2017-17869 · WordPress plugins & themes · reported by MITREMedium 6.1

  The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordcxsecurity.comcxsecurity.com

• Dec 19, 2017The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php.CVE-2017-17780 · WordPress plugins & themes · reported by MITREMedium 6.1

  The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org

• Dec 6, 2017The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.CVE-2017-17451 · WordPress plugins & themes · reported by MITREMedium 6.1

  The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.

  Product

  WP Mailster

  Fixed in

  1.5.5

  What to do

  Update WP Mailster to 1.5.5 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Nov 28, 2017The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templCVE-2017-17043 · WordPress plugins & themes · reported by MITREMedium 6.1

  The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.

  Affected

  1.0.0 to 1.0.0

  What to do

  Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Nov 27, 2017SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via the "keyword" paramCVE-2017-16955 · WordPress plugins & themes · reported by MITREHigh 8.8

  SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via the "keyword" parameter to /wp-admin/options-general.php?page=inlinks/inlinks.php.

  Product

  SQL injection vulnerability in the InLinks

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update SQL injection vulnerability in the InLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com

• Oct 24, 2017Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.CVE-2017-15863 · WordPress plugins & themes · reported by MITREMedium 6.1

  Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.

  Product

  Cross Site Scripting (XSS) exists in the wp-noexternallinks

  Fixed in

  3.5.19

  What to do

  Update Cross Site Scripting (XSS) exists in the wp-noexternallinks to 3.5.19 or newer.

  Full record and what to do →NVD recordlists.openwall.networdpress.org

• Oct 23, 2017The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.CVE-2017-15811 · WordPress plugins & themes · reported by MITREMedium 5.4

  The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.

  Product

  Pootle Button

  Fixed in

  1.2.0

  What to do

  Update Pootle Button to 1.2.0 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org

• Oct 23, 2017The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.CVE-2017-15810 · WordPress plugins & themes · reported by MITREMedium 6.1

  The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.

  Product

  PopCash.Net Code Integration Tool

  Fixed in

  1.1

  What to do

  Update PopCash.Net Code Integration Tool to 1.1 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Oct 18, 2017The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.CVE-2015-5227 · WordPress plugins & themes · reported by Red HatHigh 8.8

  The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.

  Product

  Landing Pages

  Fixed in

  1.9.2

  What to do

  Update Landing Pages to 1.9.2 or newer.

  Full record and what to do →NVD recordwordpress.orgwpvulndb.com

• Oct 2, 2017WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.CVE-2017-14848 · WordPress plugins & themes · reported by MITREHigh 8.8

  WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.

  Affected

  1.0 to 1.0

  What to do

  Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpvulndb.comexploit-db.com

• Sep 29, 2017The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cCVE-2015-9234 · WordPress plugins & themes · reported by MITREHigh 7.2

  The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.

  Product

  cp-contact-form-with-paypal (aka CP Contact Form with PayPal)

  Fixed in

  1.1.6

  What to do

  Update cp-contact-form-with-paypal (aka CP Contact Form with PayPal) to 1.1.6 or newer.

  Full record and what to do →NVD recordseclists.orgseclists.org

• Sep 27, 2017Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14847 · WordPress plugins & themes · reported by MITREHigh 8.8

  Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordexploit-db.comexploit-db.com

• Sep 27, 2017Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14846 · WordPress plugins & themes · reported by MITREHigh 8.8

  Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordexploit-db.comexploit-db.com

• Sep 27, 2017Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14845 · WordPress plugins & themes · reported by MITREHigh 8.8

  Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordexploit-db.comexploit-db.com

• Sep 27, 2017Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.CVE-2017-14844 · WordPress plugins & themes · reported by MITREHigh 8.8

  Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordexploit-db.comexploit-db.com

• Sep 27, 2017Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14843 · WordPress plugins & themes · reported by MITREHigh 8.8

  Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordexploit-db.comexploit-db.com

• Sep 27, 2017Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.CVE-2017-14842 · WordPress plugins & themes · reported by MITREHigh 8.8

  Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordexploit-db.comexploit-db.com

• Sep 17, 2017WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstraCVE-2017-14530 · WordPress plugins & themes · reported by MITREHigh 8

  WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences.

  Product

  WP_Admin_UI in the Crony Cronjob Manager

  Fixed in

  0.4.7

  What to do

  Update WP_Admin_UI in the Crony Cronjob Manager to 0.4.7 or newer.

  Full record and what to do →NVD recordcybersecurityworks.comgithub.com

• Sep 14, 2017Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter CVE-2017-1002028 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

  Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.

  Affected

  1.0 to 1.0

  What to do

  Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvapidlabs.comwordpress.org

• Sep 14, 2017Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameterCVE-2017-1002026 · WordPress plugins & themes · reported by larry0@me.comHigh 8.8

  Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.

  Affected

  3.1.37.11.l to 3.1.37.11.l

  What to do

  Affects 3.1.37.11.l to 3.1.37.11.l. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvapidlabs.comwordpress.org

• Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.phpCVE-2017-1002013 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

  Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php.

  Affected

  1.5.2 to 1.5.2

  What to do

  Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvapidlabs.comwordpress.org

• Sep 12, 2017In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extensionCVE-2015-9228 · WordPress plugins & themes · reported by MITREHigh 8.8

  In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.

  Product

  Photocrati NextGEN Gallery

  What to do

  Update Photocrati NextGEN Gallery to the newest version.

  Full record and what to do →NVD recordopenwall.comcybersecurityworks.com

• Aug 23, 2017The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.CVE-2017-13137 · WordPress plugins & themes · reported by MITRECritical 9.8

  The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.

  Affected

  1.0.5 to 1.0.5

  What to do

  Affects 1.0.5 to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Aug 18, 2017classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameCVE-2017-12947 · WordPress plugins & themes · reported by MITREHigh 7.2

  classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.

  Product

  classes\controller\admin\modals.php in the Easy Modal

  Fixed in

  2.1.0

  What to do

  Update classes\controller\admin\modals.php in the Easy Modal to 2.1.0 or newer.

  Full record and what to do →NVD recorddefensecode.comwordpress.org

• Aug 18, 2017classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameteCVE-2017-12946 · WordPress plugins & themes · reported by MITREHigh 7.2

  classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.

  Product

  classes\controller\admin\modals.php in the Easy Modal

  Fixed in

  2.1.0

  What to do

  Update classes\controller\admin\modals.php in the Easy Modal to 2.1.0 or newer.

  Full record and what to do →NVD recorddefensecode.comwordpress.org

• Aug 1, 2017The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.CVE-2017-12068 · WordPress plugins & themes · reported by MITREMedium 6.1

  The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.

  Affected

  0.7.9 to 0.7.9

  What to do

  Affects 0.7.9 to 0.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jul 7, 2017The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.CVE-2017-10991 · WordPress plugins & themes · reported by MITREMedium 6.1

  The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.

  Product

  WP Statistics

  Affected

  up to 12.0.9

  What to do

  Affects up to 12.0.9. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordlorexxar.cnlorexxar.cn

• Jun 13, 2017SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter CVE-2017-9603 · WordPress plugins & themes · reported by MITREHigh 8.8

  SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php.

  Product

  SQL injection vulnerability in the WP Jobs

  Fixed in

  1.5

  What to do

  Update SQL injection vulnerability in the WP Jobs to 1.5 or newer.

  Full record and what to do →NVD recordwordpress.orgwpvulndb.com

• Jun 13, 2017SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to CVE-2017-9429 · WordPress plugins & themes · reported by MITREHigh 8.8

  SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php.

  Product

  Event List

  Affected

  0.7.8 to 0.7.8

  What to do

  Affects 0.7.8 to 0.7.8. Update Event List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordexploit-db.comexploit-db.com

• Jun 12, 2017SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid paraCVE-2017-9418 · WordPress plugins & themes · reported by MITREHigh 8.8

  SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php.

  Product

  WP-Testimonials

  Affected

  3.4.1 to 3.4.1

  What to do

  Affects 3.4.1 to 3.4.1. Update WP-Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpvulndb.comexploit-db.com

• Apr 12, 2017SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendarCVE-2017-7719 · WordPress plugins & themes · reported by MITRECritical 9.8

  SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.

  Product

  SQL injection in the Spider Event Calendar (aka spider-event-calendar)

  Fixed in

  1.5.52

  What to do

  Update SQL injection in the Spider Event Calendar (aka spider-event-calendar) to 1.5.52 or newer.

  Full record and what to do →NVD recordlists.openwall.netsecurityfocus.com

• Aug 19, 2015SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameteCVE-2015-6522 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.

  Product

  SQL injection vulnerability in the WP Symposium

  Fixed in

  15.8

  What to do

  Update SQL injection vulnerability in the WP Symposium to 15.8 or newer.

  Full record and what to do →NVD recordwpvulndb.comexploit-db.com

• Mar 17, 2015SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in thCVE-2015-2314 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed.

  Product

  SQL injection vulnerability in the WPML

  Fixed in

  3.1.9

  What to do

  Update SQL injection vulnerability in the WPML to 3.1.9 or newer.

  Full record and what to do →NVD recordklikki.fipacketstormsecurity.com

• Jan 16, 2015SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameterCVE-2015-1055 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.

  Product

  Photo Gallery

  Affected

  1.2.7 to 1.2.7

  What to do

  Affects 1.2.7 to 1.2.7. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordseclists.orgsecurityfocus.com

• Jan 12, 2015SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands via the s parameter CVE-2014-2839 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php.

  Product

  GD Star Rating

  Affected

  19.22 to 19.22

  What to do

  Affects 19.22 to 19.22. Update GD Star Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordseclists.orgadvisories.dxw.com

• Aug 12, 2014SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter iCVE-2014-5201 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a go_view_object action to wp-admin/admin-ajax.php.

  Product

  Gallery Objects

  Affected

  0.4 to 0.4

  What to do

  Affects 0.4 to 0.4. Update Gallery Objects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comhomelab.it

• Aug 6, 2014Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter tCVE-2014-5187 · WordPress plugins & themes · reported by MITREMedium 5

  Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.

  Product

  Tom M8te (tom-m8te)

  Affected

  1.5.3 to 1.5.3

  What to do

  Affects 1.5.3 to 1.5.3. Update Tom M8te (tom-m8te) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• Feb 14, 2012SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter iCVE-2012-1067 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  Product

  WP-RecentComments

  What to do

  Update WP-RecentComments to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameteCVE-2011-4898 · WordPress plugins & themes · reported by MITREMedium 5

  wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com

• Feb 23, 2010WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.CVE-2010-0682 · WordPress plugins & themes · reported by MITREMedium 4

  WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.

  Fixed in

  2.9.2

  What to do

  Update the plugin to 2.9.2 or newer.

  Full record and what to do →NVD recordhakre.wordpress.comlists.fedoraproject.org

• Dec 28, 2009SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2009-4424 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  Product

  Pyrmont

  What to do

  Update Pyrmont to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com

• Mar 19, 2009SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameteCVE-2009-0968 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: some of these details are obtained from third party information.

  Product

  fMoblog

  What to do

  Update fMoblog to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.