Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,119 results · page 33 of 43

Dec 24, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of CVE-2014-9334 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) user or (2) password parameter in the bird-feeder page to wp-admin/options-general.php.
Product
Bird Feeder
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update Bird Feeder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 24, 2014SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrCVE-2014-8810 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action.
Product
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium
Fixed in
14.11
What to do
Update SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium to 14.11 or newer.
Full record and what to do →NVD record secunia.com security.szurek.pl
Dec 24, 2014Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script CVE-2014-8809 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter in an addComment action to ajax/profile_functions.php, (2) compose_text parameter in a sendMail action to ajax/mail_functions.php, (3) comment parameter in an add_comment action to ajax/lounge_functions.php, or (4) name parameter in a create_album action to ajax/gallery_functions.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium
Fixed in
14.11
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium to 14.11 or newer.
Full record and what to do →NVD record security.szurek.pl wpsymposium.com
Dec 19, 2014Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of CVE-2014-9368 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the username_twitterDash parameter in the twitterDash.php page to wp-admin/options-general.php.
Product
twitterDash
Affected
up to 2.1
What to do
Affects up to 2.1. Update twitterDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers to hijack the authentCVE-2014-9341 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) yurl_login or (2) yurl_anchor parameter in the yurl page to wp-admin/options-general.php.
Product
yURL ReTwitt
Affected
up to 1.4
What to do
Affects up to 1.4. Update yURL ReTwitt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authenCVE-2014-9340 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the wpCommentTwit.php page to wp-admin/options-general.php.
Product
wpCommentTwit
Affected
up to 0.5
What to do
Affects up to 0.5. Update wpCommentTwit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to hijack the authentiCVE-2014-9339 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the spnbabble.php page to wp-admin/options-general.php.
Product
SPNbabble
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update SPNbabble to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to hijack the authenticaCVE-2014-9338 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) o2t_username or (2) o2t_tags parameter to wp-admin/options-general.php.
Product
O2Tweet
Affected
up to 0.0.4
What to do
Affects up to 0.0.4. Update O2Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow remote attackers to hijCVE-2014-9337 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) twitter_kullanici or (2) twitter_sifre parameter in a kaydet action in the mikiurl.php page to wp-admin/options-general.php.
Product
Mikiurl Wordpress Eklentisi
Affected
up to 2.0
What to do
Affects up to 2.0. Update Mikiurl Wordpress Eklentisi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to hijack the authenticaCVE-2014-9336 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) itex_t_twitter_username or (2) itex_t_twitter_userpass parameter in the iTwitter.php page to wp-admin/options-general.php.
Product
iTwitter
Affected
up to 0.04
What to do
Affects up to 0.04. Update iTwitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the aCVE-2014-9335 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) email_address or (2) sidebarTitle parameter in the dandyid-services.php page to wp-admin/options-general.php.
Product
DandyID Services
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update DandyID Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Dec 19, 2014Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to injecCVE-2014-8724 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the default URI.
Product
Cross-site scripting (XSS) vulnerability in the W3 Total Cache
Fixed in
0.9.4.1
What to do
Update Cross-site scripting (XSS) vulnerability in the W3 Total Cache to 0.9.4.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 8, 2014SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote aCVE-2014-9305 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcode_products_table action to wp-admin/admin-ajax.php.
Product
SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite
Fixed in
1.5.2
What to do
Update SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite to 1.5.2 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Dec 5, 2014Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbounCVE-2014-9292 · WordPress plugins & themes · reported by MITREMedium 5.8
Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbound requests and enumerate open ports via the url parameter.
Product
jRSS Widget
Affected
up to 1.2
What to do
Affects up to 1.2. Update jRSS Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 5, 2014Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack thCVE-2014-9129 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the addons_title parameter in the CMDM_admin_settings page to wp-admin/admin.php.
Product
Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager
Fixed in
2.0.7
What to do
Update Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager to 2.0.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 5, 2014Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackCVE-2014-8800 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a newfb_update_options action.
Product
Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect
Fixed in
1.5.1
What to do
Update Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect to 1.5.1 or newer.
Full record and what to do →NVD record osvdb.org security.szurek.pl
Dec 2, 2014Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web sCVE-2014-9179 · WordPress plugins & themes · reported by MITREMedium 4
Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the "URL (optional)" field in a new ticket.
Product
SupportEzzy Ticket System
Affected
1.2.5 to 1.2.5
What to do
Affects 1.2.5 to 1.2.5. Update SupportEzzy Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 2, 2014The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlCVE-2014-9177 · WordPress plugins & themes · reported by MITREMedium 5
The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php.
Product
HTML5 MP3 Player with Playlist Free
Fixed in
2.7
What to do
Update HTML5 MP3 Player with Playlist Free to 2.7 or newer.
Full record and what to do →NVD record h4x0resec.blogspot.com packetstormsecurity.com
Dec 2, 2014SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commCVE-2014-9175 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the table_id parameter in a get_wdtable action to wp-admin/admin-ajax.php.
Product
wpDataTables
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update wpDataTables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 2, 2014Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote attacCVE-2014-9174 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Manually enter your UA code" (manual_ua_code_field) field in the General Settings.
Product
Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress)
Fixed in
5.1.3
What to do
Update Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) to 5.1.3 or newer.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Dec 2, 2014SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands CVE-2014-9173 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter.
Product
SQL injection vulnerability in view.php in the Google Doc Embedder
Fixed in
2.5.15
What to do
Update SQL injection vulnerability in view.php in the Google Doc Embedder to 2.5.15 or newer.
Full record and what to do →NVD record osvdb.org security.szurek.pl
Dec 2, 2014Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites andCVE-2014-8754 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the out parameter.
Product
Ad-Manager
Affected
1.1.2 to 1.1.2
What to do
Affects 1.1.2 to 1.1.2. Update Ad-Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 28, 2014Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitraCVE-2014-8801 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.
Product
Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro
Fixed in
1.7.15
What to do
Update Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro to 1.7.15 or newer.
Full record and what to do →NVD record packetstormsecurity.com security.szurek.pl
Nov 28, 2014Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackeCVE-2014-8799 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter to lib/dp_image.php.
Product
Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress
Fixed in
2.5.4
What to do
Update Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress to 2.5.4 or newer.
Full record and what to do →NVD record security.szurek.pl exploit-db.com
Nov 26, 2014Cross-site scripting (XSS) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via thCVE-2014-9100 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the idcode parameter in the whydowork_adsense page to wp-admin/options-general.php.
Product
WhyDoWork AdSense
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update WhyDoWork AdSense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 26, 2014Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of adminiCVE-2014-9099 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydowork_adsense page in wp-admin/options-general.php.
Product
WhyDoWork AdSense
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update WhyDoWork AdSense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 25, 2014wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveragiCVE-2014-9039 · WordPress plugins & themes · reported by MITREMedium 4.3
wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.
Fixed in
3.7.5
What to do
Update the plugin to 3.7.5 or newer.
Full record and what to do →NVD record advisories.mageia.org core.trac.wordpress.org
Nov 25, 2014wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side requCVE-2014-9038 · WordPress plugins & themes · reported by MITREMedium 6.4
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.
Fixed in
3.7.5
What to do
Update the plugin to 3.7.5 or newer.
Full record and what to do →NVD record advisories.mageia.org openwall.com
Nov 25, 2014WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008CVE-2014-9037 · WordPress plugins & themes · reported by MITREMedium 6.8
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
Fixed in
3.7.5
What to do
Update the plugin to 3.7.5 or newer.
Full record and what to do →NVD record advisories.mageia.org openwall.com
Nov 25, 2014wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial oCVE-2014-9034 · WordPress plugins & themes · reported by MITREMedium 5
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.
Fixed in
3.7.5
What to do
Update the plugin to 3.7.5 or newer.
Full record and what to do →NVD record advisories.mageia.org core.trac.wordpress.org
Nov 16, 2014The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters inCVE-2014-8949 · WordPress plugins & themes · reported by MITREMedium 6
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4w_trace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE: it is not clear whether this issue itself crosses privileges.
Product
iMember360 plugin 3.8.012
Affected
up to 3.9.001
What to do
Affects up to 3.9.001. Update iMember360 plugin 3.8.012 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Nov 16, 2014Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authenticatCVE-2014-8948 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter. NOTE: this can be leveraged with CVE-2014-8948 to execute arbitrary commands.
Product
Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012
Affected
up to 3.9.001
What to do
Affects up to 3.9.001. Update Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Nov 6, 2014Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2014-4664 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the Wordfence Security
Fixed in
5.1.4
What to do
Update Cross-site scripting (XSS) vulnerability in the Wordfence Security to 5.1.4 or newer.
Full record and what to do →NVD record hacktivity.websecgeeks.com securityfocus.com
Nov 5, 2014Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitraryCVE-2014-8622 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the search-value parameter.
Product
Compfight
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update Compfight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org packetstormsecurity.com
Nov 4, 2014SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the caliCVE-2014-8586 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter.
Product
CP Multi View Event Calendar
What to do
Update CP Multi View Event Calendar to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Nov 4, 2014Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attaCVE-2014-8584 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player)
Fixed in
1.5.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) to 1.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Oct 31, 2014The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacteCVE-2014-8334 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.
Product
WP-DBManager (aka Database Manager)
Fixed in
2.7.2
What to do
Update WP-DBManager (aka Database Manager) to 2.7.2 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Oct 27, 2014Multiple cross-site scripting (XSS) vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remote attackers to inject arbitrary web scripCVE-2014-4586 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the league parameter to (1) football_classification.php, (2) football_criteria.php, (3) templates/template_default_preview.php, or (4) templates/template_worldCup_preview.php; the (5) f parameter to football-functions.php; the id parameter in an "action" action to (6) football_groups_list.php, (7) football_matches_list.php, (8) football_matches_phase.php, or (9) football_phases_list.php; or the (10) id_league parameter in a delete action to football_matches_load.php.
Product
wp-football
Affected
up to 1.1
What to do
Affects up to 1.1. Update wp-football to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Oct 27, 2014wp-links/links.all.php in WordPress 0.70: PHP remote file inclusionCVE-2003-1599 · WordPress plugins & themes · reported by Red HatHigh 7.5
PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable.
Product
wp-links/links.all.php in WordPress 0.70
What to do
Update wp-links/links.all.php in WordPress 0.70 to the newest version.
Full record and what to do →NVD record kernelpanik.org openwall.com
Oct 24, 2014WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-FCVE-2014-6230 · WordPress plugins & themes · reported by MITREMedium 4.3
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.
Product
WP-Ban
Fixed in
1.6.4
What to do
Update WP-Ban to 1.6.4 or newer.
Full record and what to do →NVD record seclists.org security.dxw.com
Oct 22, 2014Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web scriCVE-2014-7182 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the poly_id parameter in an (1) edit_poly, (2) edit_polyline, or (3) edit_marker action in the wp-google-maps-menu page to wp-admin/admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps
Fixed in
6.0.27
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps to 6.0.27 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 21, 2014Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackersCVE-2014-4577 · WordPress plugins & themes · reported by MITREMedium 5
Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.
Product
WP AmASIN - The Amazon Affiliate Shop
Affected
up to 0.9.6
What to do
Affects up to 0.9.6. Update WP AmASIN - The Amazon Affiliate Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com plugins.svn.wordpress.org
Oct 21, 2014Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inCVE-2014-4517 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the searchString parameter.
Product
CBI Referral Manager
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update CBI Referral Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Oct 21, 2014Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackeCVE-2014-4514 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function.
Product
Alipay
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Alipay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Oct 21, 2014SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commandsCVE-2014-8375 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php.
Product
GB Gallery Slideshow
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com homelab.it
Oct 20, 2014Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to inject arbitCVE-2014-8364 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ss_id parameter.
Product
WordPress Spreadsheet (wpSS)
Affected
0.62 to 0.62
What to do
Affects 0.62 to 0.62. Update WordPress Spreadsheet (wpSS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 20, 2014SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execute arbitrary SQL comCVE-2014-8363 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.
Product
WordPress Spreadsheet (wpSS)
Affected
0.62 to 0.62
What to do
Affects 0.62 to 0.62. Update WordPress Spreadsheet (wpSS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 17, 2014Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators toCVE-2014-2995 · WordPress plugins & themes · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget
Fixed in
3.3.3
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 17, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the CVE-2014-2559 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php.
Product
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget
Fixed in
3.3.3
What to do
Update Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web scriptCVE-2014-7181 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page.
Product
Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons
Fixed in
1.26.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons to 1.26.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.