Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

490new WordPress flaws this week

397,270entries in the database

16,065 results · page 317 of 322

May 27, 2014Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users CVE-2013-2698 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Calendar
Fixed in
1.3.3
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Calendar to 1.3.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 27, 2014Cross-site scripting (XSS) vulnerability in the bib2html plugin 0.9.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the styleCVE-2014-3870 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the bib2html plugin 0.9.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the styleShortName parameter in an adminStyleAdd action to OSBiB/create/index.php.
Product
bib2html
Affected
0.9.3 to 0.9.3
What to do
Affects 0.9.3 to 0.9.3. Update bib2html to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 22, 2014Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of CVE-2013-2107 · WordPress plugins & themes · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php. NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable, but the issue might require a separate CVE identifier since this might reflect an incomplete fix.
Product
Cross-site request forgery (CSRF) vulnerability in the Mail On Update
Fixed in
5.2.0
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Mail On Update to 5.2.0 or newer.
Full record and what to do →NVD record osvdb.org seclists.org
May 22, 2014Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authenticationCVE-2014-3845 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors. NOTE: some of these details are obtained from third party information.
Product
Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker
Fixed in
1.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker to 1.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 22, 2014Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication CVE-2014-3843 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Search Everything
Fixed in
8.1.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Search Everything to 8.1.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 22, 2014Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary weCVE-2014-3842 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012
Affected
up to 3.9.001
What to do
Affects up to 3.9.001. Update Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
May 22, 2014Cross-site scripting (XSS) vulnerability in the Contact Bank plugin before 2.0.20 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2014-3841 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Contact Bank plugin before 2.0.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Label field, related to form layout configuration. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the Contact Bank
Fixed in
2.0.20
What to do
Update Cross-site scripting (XSS) vulnerability in the Contact Bank to 2.0.20 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 14, 2014Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to CVE-2013-2700 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125
Fixed in
1.5.0
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 to 1.5.0 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
May 14, 2014Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject arbitrary web script CVE-2013-1765 · WordPress plugins & themes · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) link or (2) playerready parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record osvdb.org seclists.org
May 13, 2014Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack tCVE-2013-2705 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings.
Product
Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart
Fixed in
3.6
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart to 3.6 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
May 13, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remCVE-2013-1407 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro
Fixed in
5.3.5
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro to 5.3.5 or newer.
Full record and what to do →NVD record archives.neohapsis.com wp-events-plugin.com
May 8, 2014Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, allows remote attacCVE-2013-5916 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.
Product
Bradesco Gateway
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update Bradesco Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
May 8, 2014Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated uCVE-2014-3123 · WordPress plugins & themes · reported by MITRELow 2.1
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
Product
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery
Fixed in
1.19.18
What to do
Update Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery to 1.19.18 or newer.
Full record and what to do →NVD record secunia.com securityfocus.com
Apr 25, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administCVE-2014-2579 · WordPress plugins & themes · reported by MITREHigh 7.6
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands.
Product
generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner
Affected
up to 3.5
What to do
Affects up to 3.5. Update generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Apr 11, 2014Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2014-2333 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the Lazyest Gallery
Fixed in
1.1.21
What to do
Update Cross-site scripting (XSS) vulnerability in the Lazyest Gallery to 1.1.21 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 11, 2014Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authentication of administCVE-2013-2708 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Product
Content Slide
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update Content Slide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 11, 2014Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the authentication of adCVE-2013-2706 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Product
Stream Video Player
What to do
Update Stream Video Player to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 10, 2014Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijackCVE-2013-3252 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews
Fixed in
1.63
What to do
Update Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews to 1.63 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 10, 2014Cross-site request forgery (CSRF) vulnerability in the qTranslate plugin 2.5.34 and earlier for WordPress allows remote attackers to hijack the authentication oCVE-2013-3251 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the qTranslate plugin 2.5.34 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Product
qTranslate
Affected
up to 2.5.34
What to do
Affects up to 2.5.34. Update qTranslate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 10, 2014Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack the authentication oCVE-2013-2699 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack the authentication of administrators for requests that deactivate a plugin via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the underConstruction
Fixed in
1.09
What to do
Update Cross-site request forgery (CSRF) vulnerability in the underConstruction to 1.09 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 10, 2014Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print plugin before 2.52 for WordPress allows remote attackers to hijack the authenticaCVE-2013-2693 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print plugin before 2.52 for WordPress allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print
Fixed in
2.52
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print to 2.52 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 10, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remote attackers to hijacCVE-2012-4921 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change application settings or (2) conduct cross-site scripting (XSS) attacks.
Product
DVS Custom Notification
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update DVS Custom Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 7, 2014Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows CVE-2012-1834 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php.
Product
Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View
Fixed in
0.8.9
What to do
Update Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View to 0.8.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Apr 4, 2014Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary weCVE-2013-2287 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) notify or (2) blog parameter.
Product
Uploader
What to do
Update Uploader to the newest version.
Full record and what to do →NVD record osvdb.org dognaedis.com
Apr 3, 2014Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of adminisCVE-2014-2340 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.
Product
Cross-site request forgery (CSRF) vulnerability in the XCloner
Fixed in
3.1.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the XCloner to 3.1.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 2, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the autheCVE-2013-4240 · WordPress plugins & themes · reported by Red HatMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add new groups via the hms-testimonials-addnewgroup page, (3) change default settings via the hms-testimonials-settings page, (4) change advanced settings via the hms-testimonials-settings-advanced page, (5) change custom fields settings via the hms-testimonials-settings-fields page, or (6) change template settings via the hms-testimonials-templates-new page to wp-admin/admin.php.
Product
Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials
Fixed in
2.0.11
What to do
Update Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.
Full record and what to do →NVD record osvdb.org seclists.org
Mar 28, 2014Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium plugin before 13.04 for WordPress allows remote attackers to inject arbitrary web scrCVE-2013-2695 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium plugin before 13.04 for WordPress allows remote attackers to inject arbitrary web script or HTML via the u parameter.
Product
Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium
Fixed in
13.04
What to do
Update Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium to 13.04 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Mar 28, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web scriptCVE-2013-0734 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) search_words parameter in a search action to wpf.class.php or (2) togroupusers parameter in an add_user_togroup action to fs-admin/fs-admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum
Fixed in
1.0.34
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum to 1.0.34 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Mar 14, 2014the Responsive Logo Slideshow plugin for: Cross-site scripting (XSS)CVE-2013-1759 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the "URL and Image" field.
Product
the Responsive Logo Slideshow plugin for
What to do
Update the Responsive Logo Slideshow plugin for to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Mar 14, 2014Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2013-1758 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pfad parameter to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.
Product
Marekkis Watermark
Affected
0.9.2 to 0.9.2
What to do
Affects 0.9.2 to 0.9.2. Update Marekkis Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Mar 12, 2014Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3CVE-2013-1636 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for Joomla!, and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.
Affected
up to 4.2.9
Fixed in
1.6.3
What to do
Update the plugin to 1.6.3 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Mar 9, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web scCVE-2014-2315 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) thanks_caption, (2) thanks_caption_style, or (3) thanks_style parameter to wp-admin/options.php.
Product
Thank You Counter Button
Affected
1.8.7 to 1.8.7
What to do
Affects 1.8.7 to 1.8.7. Update Thank You Counter Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Mar 6, 2014Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to CVE-2014-1906 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration
Fixed in
4.29.5
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration to 4.29.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Mar 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settiCVE-2014-2040 · WordPress plugins & themes · reported by MITRELow 2.1
Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file.
Product
Media File Renamer
Affected
1.7.0 to 1.7.0
What to do
Affects 1.7.0 to 1.7.0. Update Media File Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Mar 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inCVE-2013-3487 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified HTML header fields to (1) 400.php, (2) 403.php, or (3) 403.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record osvdb.org osvdb.org
Mar 3, 2014Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2013-1409 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the CommentLuv
Fixed in
2.92.4
What to do
Update Cross-site scripting (XSS) vulnerability in the CommentLuv to 2.92.4 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Feb 28, 2014Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script orCVE-2014-1888 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
Product
Cross-site scripting (XSS) vulnerability in the BuddyPress
Fixed in
1.9.2
What to do
Update Cross-site scripting (XSS) vulnerability in the BuddyPress to 1.9.2 or newer.
Full record and what to do →NVD record buddypress.org osvdb.org
Feb 6, 2014Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2013-7319 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field.
Product
Cross-site scripting (XSS) vulnerability in the Download Manager
Fixed in
2.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in the Download Manager to 2.5.9 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jan 20, 2014wp-includes/default-filters.php in WordPress before 3.3.3: Cross-site scripting (XSS)CVE-2012-6633 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via an editable slug field.
Product
wp-includes/default-filters.php in WordPress before 3.3.3
Fixed in
3.3.3
What to do
Update wp-includes/default-filters.php in WordPress before 3.3.3 to 3.3.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML: Cross-site scripting (XSS)CVE-2010-5295 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.
Product
wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML
Fixed in
3.0.2
What to do
Update wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allowCVE-2010-5294 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a (1) FTP or (2) SSH connection attempt.
Fixed in
3.0.2
What to do
Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web scCVE-2012-6630 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) bulk parameter to media-library-categories/add.php or (2) q parameter to media-library-categories/view.php.
Product
Media Library Categories
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update Media Library Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack theCVE-2012-6629 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com secunia.com
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web sCVE-2012-6628 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php, (3) xyz_em_email parameter to admin/edit_email.php, (4) xyz_em_exportbatchSize parameter to import_export.php, or (5) pagination limit in the Newsletter Manager options.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager
Fixed in
1.0.2
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager to 1.0.2 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to injeCVE-2012-6627 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2012-6624 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloud_is_gold_player_preview action to wp-admin/admin-ajax.php.
Product
SoundCloud Is Gold
Affected
2.1 to 2.1
What to do
Affects 2.1 to 2.1. Update SoundCloud Is Gold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackeCVE-2012-6623 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server
Fixed in
1.7.5
What to do
Update Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server to 1.7.5 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 16, 2014Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote atCVE-2012-6622 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action.
Product
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server
Fixed in
1.7.4
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server to 1.7.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 8, 2014Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script orCVE-2014-1232 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG
Fixed in
2.6.8.5
What to do
Update Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG to 2.6.8.5 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jan 8, 2014Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers tCVE-2013-7279 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter.
Product
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video
Fixed in
0.983
What to do
Update Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video to 0.983 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.