Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,546 results · page 33 of 51

Feb 24, 2020includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multipleCVE-2019-17229 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.
Product
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads)
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Feb 24, 2020includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unautCVE-2019-17228 · WordPress plugins & themes · reported by MITREMedium 6.5
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
Product
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads)
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Feb 18, 2020WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass VulnerabilitiesCVE-2013-4454 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities
Affected
1.4.1 to 1.4.1
What to do
Affects 1.4.1 to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Feb 17, 2020Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php.CVE-2020-6850 · WordPress plugins & themes · reported by MITREMedium 6.1
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.
Product
Utilities.php in the miniorange-saml-20-single-sign-on
Fixed in
4.8.84
What to do
Update Utilities.php in the miniorange-saml-20-single-sign-on to 4.8.84 or newer.
Full record and what to do →NVD record wordpress.org zeroauth.ltd
Feb 12, 2020WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution VulnerabilityCVE-2013-2010 · WordPress plugins & themes · reported by Red HatCritical 9.8
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Feb 11, 2020NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file uploadCVE-2013-3684 · WordPress plugins & themes · reported by MITRECritical 9.8
NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload
Product
NextGEN Gallery
Fixed in
1.9.13
What to do
Update NextGEN Gallery to 1.9.13 or newer.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Feb 11, 2020participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the aCVE-2020-8596 · WordPress plugins & themes · reported by MITREHigh 7.5
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
Product
Participants Database
Affected
up to 1.9.5.5
What to do
Affects up to 1.9.5.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.impenetrable.tech wpvulndb.com
Feb 8, 2020Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions CreaCVE-2014-8739 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Fixed in
1.0.0
What to do
Update the plugin to 1.0.0 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Feb 7, 2020WordPress WP Super Cache Plugin 1.2 has Remote PHP Code ExecutionCVE-2013-2009 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Feb 6, 2020The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.CVE-2020-8772 · WordPress plugins & themes · reported by MITRECritical 9.8
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.
Product
InfiniteWP Client
Fixed in
1.9.4.5
What to do
Update InfiniteWP Client to 1.9.4.5 or newer.
Full record and what to do →NVD record wpvulndb.com webarxsecurity.com
Feb 5, 2020The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF.CVE-2020-8658 · WordPress plugins & themes · reported by MITREHigh 8.8
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.
Product
BestWebSoft Htaccess
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update BestWebSoft Htaccess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Feb 5, 2020The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.CVE-2019-20173 · WordPress plugins & themes · reported by MITREMedium 6.1
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
Product
Auth0 wp-auth0 plugin 3.11.x
Fixed in
3.11.3
What to do
Update Auth0 wp-auth0 plugin 3.11.x to 3.11.3 or newer.
Full record and what to do →NVD record auth0.com github.com
Jan 30, 2020XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter.CVE-2020-8498 · WordPress plugins & themes · reported by MITREMedium 5.4
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
Product
XSS exists in the shortcode functionality of the GistPress
Fixed in
3.0.2
What to do
Update XSS exists in the shortcode functionality of the GistPress to 3.0.2 or newer.
Full record and what to do →NVD record github.com github.com
Jan 27, 2020WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerabilityCVE-2013-4462 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 23, 2020WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.CVE-2012-6649 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.
Affected
1.1.21 to 1.1.21
What to do
Affects 1.1.21 to 1.1.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 21, 2020The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.CVE-2020-6849 · WordPress plugins & themes · reported by MITREHigh 8.8
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.
Product
marketo-forms-and-tracking
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update marketo-forms-and-tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 17, 2020The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.CVE-2020-7104 · WordPress plugins & themes · reported by MITREMedium 6.1
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.
Affected
1.1.8.1 to 1.1.8.1
What to do
Affects 1.1.8.1 to 1.1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Jan 16, 2020The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.CVE-2020-7107 · WordPress plugins & themes · reported by MITREMedium 6.1
The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.
Product
Ultimate FAQ
Fixed in
1.8.30
What to do
Update Ultimate FAQ to 1.8.30 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 13, 2020Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remotCVE-2020-6859 · WordPress plugins & themes · reported by MITREMedium 5.3
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.
Product
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Dec 30, 2019An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.CVE-2019-20141 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
Product
Laborator Neon
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update Laborator Neon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record knassar702.github.io knassar7o2.blogspot.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers tCVE-2014-4550 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
Product
Shortcode Ninja
Affected
up to 1.4
What to do
Affects up to 1.4. Update Shortcode Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6CVE-2014-4536 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.
Fixed in
1.5.6
What to do
Update the plugin to 1.5.6 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org
Dec 27, 2019Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116CVE-2014-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Product
Video Comments Webcam Recorder
Fixed in
20140116
What to do
Update Video Comments Webcam Recorder to 20140116 or newer.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Dec 27, 2019Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackersCVE-2014-4558 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
Product
Swipe Checkout for WooCommerce
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Swipe Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrCVE-2014-4548 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the popup parameter.
Product
Ruven Toolkit
Affected
up to 1.1
What to do
Affects up to 1.1. Update Ruven Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to CVE-2014-4592 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Product
WP-Planet
Affected
up to 0.1
What to do
Affects up to 0.1. Update WP-Planet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remoCVE-2014-4559 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) api_key, (2) payment_page_url, (3) merchant_id, (4) api_url, or (5) currency parameter.
Product
Swipe Checkout for WP e-Commerce
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Swipe Checkout for WP e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for WordPress allows remotCVE-2014-4525 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.
Product
Ebay Feeds for
Affected
up to 1.1
What to do
Affects up to 1.1. Update Ebay Feeds for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wordpress.org
Dec 27, 2019In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a pCVE-2019-20043 · WordPress plugins & themes · reported by MITREMedium 4.3
In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record core.trac.wordpress.org github.com
Dec 27, 2019In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scCVE-2019-20042 · WordPress plugins & themes · reported by MITREMedium 6.1
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.ripstech.com core.trac.wordpress.org
Dec 27, 2019wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization,CVE-2019-20041 · WordPress plugins & themes · reported by MITRECritical 9.8
wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript&colon; substring.
Fixed in
5.3.1
What to do
Update the plugin to 5.3.1 or newer.
Full record and what to do →NVD record github.com lists.debian.org
Dec 26, 2019WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code.CVE-2013-2011 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009.
Fixed in
1.3.2
What to do
Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Dec 11, 2019Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbCVE-2013-5978 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977.
Product
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite
Fixed in
1.5.1.15
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite to 1.5.1.15 or newer.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Nov 18, 2019The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album,CVE-2019-14467 · WordPress plugins & themes · reported by MITREHigh 7.8
The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.CVE-2019-17237 · WordPress plugins & themes · reported by MITREHigh 8.8
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.
Product
includes/class-coming-soon-creator.php in the igniteup
Affected
up to 3.4
What to do
Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.CVE-2019-17236 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.
Product
includes/class-coming-soon-creator.php in the igniteup
Affected
up to 3.4
What to do
Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.CVE-2019-17235 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.
Product
includes/class-coming-soon-creator.php in the igniteup
Affected
up to 3.4
What to do
Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.CVE-2019-17234 · WordPress plugins & themes · reported by MITREHigh 7.5
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
Product
includes/class-coming-soon-creator.php in the igniteup
Affected
up to 3.4
What to do
Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Nov 6, 2019Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote CVE-2014-9014 · WordPress plugins & themes · reported by MITREMedium 4.3
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote authenticated users to download arbitrary files via a .. (dot dot) in the file parameter.
Product
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace
Fixed in
2.4.1
What to do
Update Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace to 2.4.1 or newer.
Full record and what to do →NVD record security.szurek.pl exploit-db.com
Nov 6, 2019The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary userCVE-2014-9013 · WordPress plugins & themes · reported by MITREHigh 8.8
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.
Product
WP Marketplace
Affected
2.4.0 to 2.4.0
What to do
Affects 2.4.0 to 2.4.0. Update WP Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 31, 2019plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.CVE-2019-16251 · WordPress plugins & themes · reported by MITREMedium 4.3
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
Product
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Oct 22, 2019The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.CVE-2015-9499 · WordPress plugins & themes · reported by MITRECritical 9.8
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.
Product
Showbiz Pro
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Showbiz Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Oct 22, 2019The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.CVE-2015-9497 · WordPress plugins & themes · reported by MITREHigh 8.8
The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.
Product
ad-inserter
Fixed in
1.5.3
What to do
Update ad-inserter to 1.5.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Oct 22, 2019The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.CVE-2015-9496 · WordPress plugins & themes · reported by MITREHigh 8.8
The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.
Product
freshmail-newsletter
Fixed in
1.6
What to do
Update freshmail-newsletter to 1.6 or newer.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Oct 18, 2019A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress.CVE-2019-17207 · WordPress plugins & themes · reported by MITREMedium 5.4
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.
Product
broken-link-checker (aka Broken Link Checker)
Affected
up to 1.11.8
What to do
Affects up to 1.11.8. Update broken-link-checker (aka Broken Link Checker) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 10, 2019The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php.CVE-2019-17386 · WordPress plugins & themes · reported by MITREHigh 8.8
The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php.
Product
animate-it
Fixed in
2.3.6
What to do
Update animate-it to 2.3.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 10, 2019The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.CVE-2015-9480 · WordPress plugins & themes · reported by MITREHigh 7.5
The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.
Affected
5 to 5
What to do
Affects 5 to 5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 10, 2019The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.CVE-2015-9473 · WordPress plugins & themes · reported by MITREHigh 7.5
The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.
Product
estrutura-basica
Affected
up to 2015-09-13
What to do
Affects up to 2015-09-13. Update estrutura-basica to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 10, 2019The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header.CVE-2015-9472 · WordPress plugins & themes · reported by MITREMedium 6.1
The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header.
Product
incoming-links
Fixed in
0.9.10b
What to do
Update incoming-links to 0.9.10b or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 10, 2019The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.CVE-2015-9471 · WordPress plugins & themes · reported by MITRECritical 9.8
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.
Product
dzs-zoomsounds
Affected
up to 2.0
What to do
Affects up to 2.0. Update dzs-zoomsounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.