Critical security advisoryCriticalFlagged by our vulnerability database: A flaw in WordPress’s own updater is being exploited. Sites need 7.1.4. See if your site is affectedFlagged by our vulnerability database: WordPress updater flaw is being exploited. DetailsExploited: WordPress 7.1.4. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list
40added in the last 30 days
447new WordPress flaws this week
397,270entries in the database

16,065 results · page 322 of 322

  • Apr 9, 2007wp-includes/general-template.php in WordPress before 20070309: Cross-site scripting (XSS)CVE-2007-1894 · WordPress plugins & themes · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wp_title function.

    Product
    wp-includes/general-template.php in WordPress before 20070309
    Fixed in
    20070309
    What to do
    Update wp-includes/general-template.php in WordPress before 20070309 to 20070309 or newer.

    Full record and what to do →NVD recordchxsecurity.orgsecunia.com

  • Mar 28, 2007an mt import in wp-admin/admin.php in WordPress 2.1.2: Cross-site scripting (XSS)CVE-2007-1732 · WordPress plugins & themes · reported by MITRELow 3.5

    Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor

    Product
    an mt import in wp-admin/admin.php in WordPress 2.1.2
    What to do
    Update an mt import in wp-admin/admin.php in WordPress 2.1.2 to the newest version.

    Full record and what to do →NVD recordcodex.wordpress.orgmarc.info

  • Mar 22, 2007wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series,: Cross-site scripting (XSS)CVE-2007-1622 · WordPress plugins & themes · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF.

    Product
    wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series,
    Fixed in
    2.0.10
    What to do
    Update wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, to 2.0.10 or newer.

    Full record and what to do →NVD recordsecunia.comsecunia.com

  • Mar 3, 2007the AdminPanel in WordPress 2.1.1 and earlier: Cross-site request forgery (CSRF)CVE-2007-1244 · WordPress plugins & themes · reported by MITREMedium 6.8

    Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.

    Product
    the AdminPanel in WordPress 2.1.1 and earlier
    Affected
    up to 2.1.1
    What to do
    Affects up to 2.1.1. Update the AdminPanel in WordPress 2.1.1 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org

  • Mar 2, 2007Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web CVE-2007-1230 · WordPress plugins & themes · reported by MITREMedium 5.8

    Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via (1) the Referer HTTP header or (2) the URI, a different vulnerability than CVE-2007-1049.

    Fixed in
    2.1.2-alpha
    What to do
    Update the plugin to 2.1.2-alpha or newer.

    Full record and what to do →NVD recordosvdb.orgsecunia.com

  • Feb 21, 2007the wp_explain_nonce function in the nonce AYS functionality: Cross-site scripting (XSS)CVE-2007-1049 · WordPress plugins & themes · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.

    Product
    the wp_explain_nonce function in the nonce AYS functionality
    Fixed in
    2.0.9
    What to do
    Update the wp_explain_nonce function in the nonce AYS functionality to 2.0.9 or newer.

    Full record and what to do →NVD recorddownloads.securityfocus.comosvdb.org

  • Jan 8, 2007the CSRF protection scheme in WordPress before 2.0.6: Cross-site scripting (XSS)CVE-2007-0106 · WordPress plugins & themes · reported by MITREMedium 6.8

    Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request.

    Product
    the CSRF protection scheme in WordPress before 2.0.6
    Fixed in
    2.0.6
    What to do
    Update the CSRF protection scheme in WordPress before 2.0.6 to 2.0.6 or newer.

    Full record and what to do →NVD recordosvdb.orgsecunia.com

  • Dec 28, 2006wp-admin/templates.php in WordPress 2.0.5: Cross-site scripting (XSS)CVE-2006-6808 · WordPress plugins & themes · reported by MITREMedium 6.8

    Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php.

    Product
    wp-admin/templates.php in WordPress 2.0.5
    What to do
    Update wp-admin/templates.php in WordPress 2.0.5 to the newest version.

    Full record and what to do →NVD recordmarc.infomichaeldaw.org

  • Apr 17, 2006Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions beforCVE-2006-1796 · WordPress plugins & themes · reported by MITREMedium 6.8

    Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).

    Fixed in
    2.0.1
    What to do
    Update the plugin to 2.0.1 or newer.

    Full record and what to do →NVD recordbugs.debian.orgtrac.wordpress.org

  • Mar 18, 2006Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unCVE-2006-1263 · WordPress plugins & themes · reported by MITREMedium 4.3

    Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

    Fixed in
    2.0.2
    What to do
    Update the plugin to 2.0.2 or newer.

    Full record and what to do →NVD recordwordpress.orgsecurityfocus.com

  • Mar 3, 2006Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrarCVE-2006-0985 · WordPress plugins & themes · reported by MITREMedium 4.3

    Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) website, and (3) comment parameters.

    Affected
    up to 2.0.1
    What to do
    Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordneosecurityteam.netsecunia.com

  • Feb 16, 2006WordPress 2.0.0: Cross-site scripting (XSS)CVE-2006-0733 · WordPress plugins & themes · reported by MITRELow 2.6

    Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability

    Product
    WordPress 2.0.0
    What to do
    Update WordPress 2.0.0 to the newest version.

    Full record and what to do →NVD recordmyimei.comsecurityfocus.com

  • Jul 5, 2005Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML vCVE-2005-2107 · WordPress plugins & themes · reported by MITREMedium 4.3

    Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p or (2) comment parameter.

    Affected
    up to 1.5.1.2
    What to do
    Affects up to 1.5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordmarc.infosecunia.com

  • May 2, 2005Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to execute arbitrary commCVE-2005-1102 · WordPress plugins & themes · reported by MITREMedium 6.8

    Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to execute arbitrary commands via the (1) content or (2) title of the post.

    Affected
    up to 1.5
    What to do
    Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordbugs.gentoo.orgmarc.info

  • Dec 31, 2004Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, textCVE-2004-1559 · WordPress plugins & themes · reported by MITREMedium 4.3

    Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordmarc.infosecunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.