Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16,063 results · page 307 of 322
Mar 18, 2021Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vCVE-2021-24129 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.
- Product
- Themify Portfolio Post
- Fixed in
- 1.1.6
- What to do
- Update Themify Portfolio Post to 1.1.6 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowingCVE-2021-24128 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker (contributor+) to inject arbitrary web script or HTML via the 'Description/biography' of a member.
- Product
- Team Members
- Fixed in
- 5.0.4
- What to do
- Update Team Members to 5.0.4 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site ScriptCVE-2021-24124 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation.
- Product
- WP Shieldon
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update WP Shieldon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 10, 2021Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-secuCVE-2020-29171 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.
- Fixed in
- 4.4.6
- What to do
- Update the plugin to 4.4.6 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Feb 9, 2021A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload.CVE-2020-35943 · WordPress plugins & themes · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
- Product
- A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery
- Fixed in
- 3.5.0
- What to do
- Update A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery to 3.5.0 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 9, 2021A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modiCVE-2020-35942 · WordPress plugins & themes · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
- Product
- A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery
- Fixed in
- 3.5.0
- What to do
- Update A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery to 3.5.0 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 5, 2021Name Directory 1.17.4 and earlier: Cross-site request forgery (CSRF)CVE-2021-20652 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- Name Directory 1.17.4 and earlier
- Affected
- up to 1.17.4
- What to do
- Affects up to 1.17.4. Update Name Directory 1.17.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 19, 2021The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugCVE-2020-28707 · WordPress plugins & themes · reported by MITREMedium 6.1
The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the "e" variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,'*') for that object.
- Product
- Stockdio Historical Chart
- Fixed in
- 2.8.1
- What to do
- Update Stockdio Historical Chart to 2.8.1 or newer.
Full record and what to do →NVD recordjondow.euwordpress.org
Jan 15, 2021Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authentCVE-2020-35748 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter.
- Product
- Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player
- Fixed in
- 7.4.37.727
- What to do
- Update Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player to 7.4.37.727 or newer.
Full record and what to do →NVD recorddocs.google.comgithub.com
Dec 31, 2020Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layoutCVE-2020-35937 · WordPress plugins & themes · reported by MITREHigh 7.5
Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.
- Product
- Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase
- Fixed in
- 1.22.16
- What to do
- Update Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase to 1.22.16 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 31, 2020Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts incCVE-2020-35936 · WordPress plugins & themes · reported by MITREHigh 7.5
Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.
- Product
- Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid
- Fixed in
- 2.0.73
- What to do
- Update Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid to 2.0.73 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 31, 2020A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victimCVE-2020-35933 · WordPress plugins & themes · reported by MITREMedium 6.5
A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.
- Product
- A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter
- Fixed in
- 6.8.2
- What to do
- Update A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 25, 2020A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.CVE-2020-29172 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.
- Product
- A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache
- Fixed in
- 3.6.1
- What to do
- Update A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache to 3.6.1 or newer.
Full record and what to do →NVD recordwordpress.orglitespeedtech.com
Dec 14, 2020A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have conviCVE-2020-29304 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim is proceeding through the file import workflow.
- Fixed in
- 1.3.46
- What to do
- Update the plugin to 1.3.46 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 14, 2020A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script orCVE-2020-29303 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with _drts_form_build_id parameter containing the XSS payload and _t_ parameter set to an invalid or non-existent CSRF token.
- Product
- SabaiApp Directories Pro
- Affected
- 1.3.45 to 1.3.45
- What to do
- Affects 1.3.45 to 1.3.45. Update SabaiApp Directories Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 21, 2020Simple Download Monitor 3.8.8 and earlier: Cross-site scriptingCVE-2020-5650 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Simple Download Monitor 3.8.8 and earlier
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update Simple Download Monitor 3.8.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2020Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php.CVE-2020-26672 · WordPress plugins & themes · reported by MITREMedium 5.4
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database.
- Fixed in
- 3.0.3
- What to do
- Update the plugin to 3.0.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Oct 14, 2020Live Chat - Live support version 3.1.0 and earlier: Cross-site request forgery (CSRF)CVE-2020-5642 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- Live Chat - Live support version 3.1.0 and earlier
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Live Chat - Live support version 3.1.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org
Sep 14, 2020Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php.CVE-2020-25380 · WordPress plugins & themes · reported by MITREMedium 5.4
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.
- Affected
- 0.8 to 0.8
- What to do
- Affects 0.8 to 0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Sep 14, 2020Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.CVE-2020-25378 · WordPress plugins & themes · reported by MITREMedium 6.1
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.
- Affected
- 1.3.0 to 1.3.0
- What to do
- Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Sep 14, 2020Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field,CVE-2020-25375 · WordPress plugins & themes · reported by MITREMedium 5.4
Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field, Address field, Town field, Phone field, Mobile field, Place of Birth field, Web Site field, VAT Number field, Last Name field, Fax field, Email field, and Skype field.
- Affected
- 1.8.7 to 1.8.7
- What to do
- Affects 1.8.7 to 1.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Aug 14, 2020A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary weCVE-2019-6112 · WordPress plugins & themes · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).
- Product
- Sell Media
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Sell Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.commetamorfosec.com
Jul 27, 2020Social Sharing Plugin versions prior to 1.2.10: Cross-site request forgery (CSRF)CVE-2020-5611 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- Social Sharing Plugin versions prior to 1.2.10
- Fixed in
- 1.2.10
- What to do
- Update Social Sharing Plugin versions prior to 1.2.10 to 1.2.10 or newer.
Jul 21, 2020A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to injecCVE-2020-14063 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.
- Product
- A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript
- Fixed in
- 1.2.2
- What to do
- Update A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript to 1.2.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 17, 2020Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legCVE-2020-5767 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.5
Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link.
- Affected
- 4.4.8 to 4.4.8
- What to do
- Affects 4.4.8 to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Jul 9, 2020A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submiCVE-2020-15299 · WordPress plugins & themes · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is executed in the victim's browser.
- Product
- A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 22, 2020the forms it presents, allowing the possibility of deleting records: The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF)CVE-2020-13426 · WordPress plugins & themes · reported by MITREMedium 6.5
The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.
- Product
- the forms it presents, allowing the possibility of deleting records
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the forms it presents, allowing the possibility of deleting records to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record0day.todaycxsecurity.com
Jun 19, 2020WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSSCVE-2019-20891 · WordPress plugins & themes · reported by MITREHigh 8.8
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.
- Fixed in
- 3.6.5
- What to do
- Update the plugin to 3.6.5 or newer.
Full record and what to do →NVD recordblog.ripstech.comraw.githubusercontent.com
May 6, 2020A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject aCVE-2020-11727 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.
- Product
- AlgolPlus Advanced Order Export For WooCommerce
- Affected
- 3.1.3 to 3.1.3
- What to do
- Affects 3.1.3 to 3.1.3. Update AlgolPlus Advanced Order Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Apr 30, 2020the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting: In affected versions of WordPress, aCVE-2020-11029 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
- Product
- the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting
- What to do
- Update the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting to the newest version.
Full record and what to do →NVD recordgithub.comlists.debian.org
Apr 30, 2020the navigation section of Customizer: In affected versions of WordPress, a cross-site scripting (XSS)CVE-2020-11025 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
- Product
- the navigation section of Customizer
- What to do
- Update the navigation section of Customizer to the newest version.
Full record and what to do →NVD recordgithub.comwordpress.org
Apr 1, 2020A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.CVE-2020-5392 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.
- Product
- A stored cross-site scripting (XSS) vulnerability exists in the Auth0
- Fixed in
- 4.0.0
- What to do
- Update A stored cross-site scripting (XSS) vulnerability exists in the Auth0 to 4.0.0 or newer.
Apr 1, 2020Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.CVE-2020-5391 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.
- Product
- Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0
- Fixed in
- 4.0.0
- What to do
- Update Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 to 4.0.0 or newer.
Mar 24, 2020A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.CVE-2020-10385 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
- Product
- A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite)
- Fixed in
- 1.5.9
- What to do
- Update A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) to 1.5.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Feb 28, 2020Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticaCVE-2020-9459 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.
- Product
- Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite
- Affected
- up to 5.1.6
- What to do
- Affects up to 5.1.6. Update Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Feb 18, 2020Easy Property Listings versions prior to 3.4: Cross-site request forgery (CSRF)CVE-2020-5530 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- Easy Property Listings versions prior to 3.4
- Fixed in
- 3.4
- What to do
- Update Easy Property Listings versions prior to 3.4 to 3.4 or newer.
Feb 11, 2020A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.CVE-2013-5988 · WordPress plugins & themes · reported by MITREMedium 6.1
A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.
- Product
- A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack
- Fixed in
- 2.0.3.1
- What to do
- Update A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack to 2.0.3.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Feb 8, 2020Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitraryCVE-2015-1394 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery
- Fixed in
- 1.2.11
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery to 1.2.11 or newer.
Full record and what to do →NVD recordsecurityfocus.complugins.trac.wordpress.org
Jan 30, 2020Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web scCVE-2013-4241 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials
- Fixed in
- 2.0.11
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 28, 2020Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication ofCVE-2015-5483 · WordPress plugins & themes · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.
- Product
- Private Only
- Affected
- 3.5.1 to 3.5.1
- What to do
- Affects 3.5.1 to 3.5.1. Update Private Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 28, 2020Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parametCVE-2013-2714 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parameter.
- Affected
- 8.8.10.13 to 8.8.10.13
- What to do
- Affects 8.8.10.13 to 8.8.10.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jan 15, 2020Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTMCVE-2015-5484 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post.
- Product
- Cross-site scripting (XSS) vulnerability in the Plotly
- Fixed in
- 1.0.3
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Plotly to 1.0.3 or newer.
Full record and what to do →NVD recordseclists.orgsecurity.dxw.com
Jan 6, 2020Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web scrCVE-2015-4039 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2.
- Product
- WP Membership
- Affected
- 1.2.3 to 1.2.3
- What to do
- Affects 1.2.3 to 1.2.3. Update WP Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jan 2, 2020Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTMCVE-2014-4553 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters.
- Product
- spreadshirt-rss-3d-cube-flash-gallery
- Affected
- 2014 to 2014
- What to do
- Affects 2014 to 2014. Update spreadshirt-rss-3d-cube-flash-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers tCVE-2014-4550 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
- Product
- Shortcode Ninja
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Shortcode Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Dec 27, 2019Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6CVE-2014-4536 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.
- Fixed in
- 1.5.6
- What to do
- Update the plugin to 1.5.6 or newer.
Full record and what to do →NVD recordcodevigilant.comwordpress.org
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script CVE-2014-4535 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
- Product
- Import Legacy Media
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Import Legacy Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116CVE-2014-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
- Product
- Video Comments Webcam Recorder
- Fixed in
- 20140116
- What to do
- Update Video Comments Webcam Recorder to 20140116 or newer.
Full record and what to do →NVD recordcodevigilant.complugins.trac.wordpress.org
Dec 27, 2019Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackersCVE-2014-4558 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
- Product
- Swipe Checkout for WooCommerce
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Swipe Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrCVE-2014-4548 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the popup parameter.
- Product
- Ruven Toolkit
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Ruven Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.