Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,713 results · page 35 of 35
Aug 21, 2019The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.CVE-2012-6715 · WordPress plugins & themes · reported by MITREMedium 6.1
The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.
- Product
- formbuilder
- Fixed in
- 0.9.1
- What to do
- Update formbuilder to 0.9.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 16, 2019The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.CVE-2019-15114 · WordPress plugins & themes · reported by MITREHigh 8.8
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
- Product
- formcraft-form-builder
- Fixed in
- 1.2.2
- What to do
- Update formcraft-form-builder to 1.2.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 6, 2019A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress.CVE-2019-14695 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is mishandled.
- Product
- A SQL injection vulnerability exists in the Sygnoos Popup Builder
- Fixed in
- 3.45
- What to do
- Update A SQL injection vulnerability exists in the Sygnoos Popup Builder to 3.45 or newer.
Full record and what to do →NVD recordfortiguard.comwordpress.org
Apr 26, 2019The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inCVE-2019-11557 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
- Product
- WebDorado Contact Form Builder
- Fixed in
- 1.0.69
- What to do
- Update WebDorado Contact Form Builder to 1.0.69 or newer.
Full record and what to do →NVD recordseclists.orglists.openwall.net
Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] CVE-2019-9568 · WordPress plugins & themes · reported by MITREMedium 6.5
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the attacker has the delete permission.
- Product
- Forminator Contact Form, Poll & Quiz Builder
- Fixed in
- 1.6
- What to do
- Update Forminator Contact Form, Poll & Quiz Builder to 1.6 or newer.
Full record and what to do →NVD recordlists.openwall.netsecurity-consulting.icu
Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.CVE-2019-9567 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.
- Product
- Forminator Contact Form, Poll & Quiz Builder
- Fixed in
- 1.6
- What to do
- Update Forminator Contact Form, Poll & Quiz Builder to 1.6 or newer.
Full record and what to do →NVD recordlists.openwall.netsecurity-consulting.icu
Oct 26, 2017The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php.CVE-2017-15919 · WordPress plugins & themes · reported by MITRECritical 9.8
The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php.
- Product
- ultimate-form-builder-lite
- Fixed in
- 1.3.7
- What to do
- Update ultimate-form-builder-lite to 1.3.7 or newer.
Full record and what to do →NVD recordsecurityfocus.comwordpress.org
Oct 6, 2017Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attacCVE-2014-8492 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) site_name, (2) message, or (3) site_url parameter.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder
- Fixed in
- 2.0.3
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder to 2.0.3 or newer.
Full record and what to do →NVD recordg0blin.co.ukwpvulndb.com
Sep 14, 2017Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/CVE-2017-1002002 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.CVE-2017-1002001 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.
- Affected
- 1.05 to 1.05
- What to do
- Affects 1.05 to 1.05. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Sep 14, 2017Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php dCVE-2017-1002000 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content.
- Affected
- 3.0 to 3.0
- What to do
- Affects 3.0 to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Oct 10, 2016Reflected XSS in wordpress plugin page-layout-builder v1.9.3CVE-2016-1000141 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin page-layout-builder v1.9.3
- Affected
- up to 1.9.3
- What to do
- Affects up to 1.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Jun 25, 2014Cross-site request forgery (CSRF) vulnerability in the Login rebuilder plugin before 1.2.0 for WordPress allows remote attackers to hijack the authentication ofCVE-2014-3882 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Login rebuilder plugin before 1.2.0 for WordPress allows remote attackers to hijack the authentication of arbitrary users.
- Product
- Cross-site request forgery (CSRF) vulnerability in the Login rebuilder
- Fixed in
- 1.2.0
- What to do
- Update Cross-site request forgery (CSRF) vulnerability in the Login rebuilder to 1.2.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.