Updated 35 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

2,546 results · page 36 of 51

Sep 9, 2019search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.CVE-2019-15895 · WordPress plugins & themes · reported by MITREHigh 7.5
search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.
Product
search-exclude.php in the "Search Exclude
Fixed in
1.2.4
What to do
Update search-exclude.php in the "Search Exclude to 1.2.4 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 8, 2019SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameCVE-2019-16119 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.
Product
SQL injection in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update SQL injection in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.CVE-2019-16118 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.CVE-2019-16117 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 4, 2019cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_desCVE-2019-14470 · WordPress plugins & themes · reported by MITREMedium 6.1
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
Product
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro
Affected
up to 4.9.32
What to do
Affects up to 4.9.32. Update cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Sep 3, 2019The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with theCVE-2019-15873 · WordPress plugins & themes · reported by MITREHigh 8.8
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.
Product
profilegrid-user-profiles-groups-and-communities
Fixed in
2.8.6
What to do
Update profilegrid-user-profiles-groups-and-communities to 2.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.CVE-2019-15866 · WordPress plugins & themes · reported by MITREHigh 8.8
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.
Product
crelly-slider
Fixed in
1.3.5
What to do
Update crelly-slider to 1.3.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Product
admin/includes/class.import.snippet.php in the "Woody ad snippets
Fixed in
2.2.5
What to do
Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Aug 30, 2019The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.CVE-2019-15829 · WordPress plugins & themes · reported by MITREMedium 4.8
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
Product
photoblocks-grid-gallery
Fixed in
1.1.33
What to do
Update photoblocks-grid-gallery to 1.1.33 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.CVE-2019-15826 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
Product
wps-hide-login
Fixed in
1.5.3
What to do
Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 30, 2019The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.CVE-2019-15822 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.
Product
wps-child-theme-generator
Fixed in
1.2
What to do
Update wps-child-theme-generator to 1.2 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 30, 2019The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15819 · WordPress plugins & themes · reported by MITRECritical 9.8
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Product
nd-restaurant-reservations
Fixed in
1.5
What to do
Update nd-restaurant-reservations to 1.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 29, 2019The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.CVE-2019-15777 · WordPress plugins & themes · reported by MITREMedium 5.4
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
Product
shapepress-dsgvo
Fixed in
2.2.19
What to do
Update shapepress-dsgvo to 2.2.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.CVE-2017-18591 · WordPress plugins & themes · reported by MITREMedium 6.1
The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
Product
gd-rating-system
Fixed in
2.1
What to do
Update gd-rating-system to 2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.CVE-2019-15647 · WordPress plugins & themes · reported by MITREHigh 8.8
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
Product
groundhogg
Fixed in
1.3.5
What to do
Update groundhogg to 1.3.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.CVE-2018-20987 · WordPress plugins & themes · reported by MITRECritical 9.8
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.
Product
newsletters-lite
Fixed in
4.6.8.6
What to do
Update newsletters-lite to 4.6.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess fCVE-2015-9340 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
Product
wp-file-upload
Fixed in
3.0.0
What to do
Update wp-file-upload to 3.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.CVE-2015-9338 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
Product
wp-file-upload
Fixed in
2.5.0
What to do
Update wp-file-upload to 2.5.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.CVE-2015-9341 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
Product
wp-file-upload
Fixed in
3.4.1
What to do
Update wp-file-upload to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.CVE-2018-20985 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.
Product
wp-payeezy-pay
Fixed in
2.98
What to do
Update wp-payeezy-pay to 2.98 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.CVE-2017-18583 · WordPress plugins & themes · reported by MITRECritical 9.8
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
Product
post-pay-counter
Fixed in
2.731
What to do
Update post-pay-counter to 2.731 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10927 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.11
What to do
Update nelio-ab-testing to 4.5.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10926 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.9
What to do
Update nelio-ab-testing to 4.5.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.CVE-2017-18521 · WordPress plugins & themes · reported by MITREHigh 8.8
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
Product
democracy-poll
Fixed in
5.4
What to do
Update democracy-poll to 5.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 21, 2019The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.CVE-2014-10377 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
Product
cforms2
Fixed in
13.2
What to do
Update cforms2 to 13.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.CVE-2017-18520 · WordPress plugins & themes · reported by MITREMedium 6.1
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
Product
democracy-poll
Fixed in
5.4
What to do
Update democracy-poll to 5.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 20, 2019The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.CVE-2015-9332 · WordPress plugins & themes · reported by MITREMedium 6.5
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Product
uninstall
Fixed in
1.2
What to do
Update uninstall to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.CVE-2019-14789 · WordPress plugins & themes · reported by MITREMedium 6.1
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
Affected
3.2.8 to 3.2.8
What to do
Affects 3.2.8 to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 15, 2019wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultCVE-2019-14788 · WordPress plugins & themes · reported by MITREHigh 8.8
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
Product
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters
Fixed in
4.6.19
What to do
Update wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.CVE-2019-14786 · WordPress plugins & themes · reported by MITREMedium 6.5
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.
Fixed in
1.0.27.1
What to do
Update the plugin to 1.0.27.1 or newer.
Full record and what to do →NVD record rankmath.com wpvulndb.com
Aug 15, 2019The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked CVE-2019-14795 · WordPress plugins & themes · reported by MITREMedium 4.8
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,CVE-2019-14790 · WordPress plugins & themes · reported by MITREMedium 6.1
The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameterCVE-2015-9316 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Product
wp-fastest-cache
Fixed in
0.8.4.9
What to do
Update wp-fastest-cache to 0.8.4.9 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=CVE-2019-14798 · WordPress plugins & themes · reported by MITREMedium 4.9
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
Product
10Web Photo Gallery
Fixed in
1.5.25
What to do
Update 10Web Photo Gallery to 1.5.25 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?actioCVE-2019-14796 · WordPress plugins & themes · reported by MITREMedium 5.4
The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.CVE-2019-14791 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
Affected
1.3.18 to 1.3.18
What to do
Affects 1.3.18 to 1.3.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.CVE-2019-14793 · WordPress plugins & themes · reported by MITREMedium 6.5
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
Product
Meta Box
Fixed in
4.16.3
What to do
Update Meta Box to 4.16.3 or newer.
Full record and what to do →NVD record metabox.io pluginvulnerabilities.com
Aug 9, 2019The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameterCVE-2019-14787 · WordPress plugins & themes · reported by MITREMedium 5.4
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
Product
Tribulant Newsletters
Fixed in
4.6.19
What to do
Update Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.phpCVE-2019-14785 · WordPress plugins & themes · reported by MITREMedium 5.4
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
Product
CP Contact Form with PayPal
Fixed in
1.2.99
What to do
Update CP Contact Form with PayPal to 1.2.99 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 9, 2019The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated byCVE-2016-10865 · WordPress plugins & themes · reported by MITREMedium 6.1
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
Product
Lightbox Plus Colorbox
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Lightbox Plus Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatcheCVE-2019-14774 · WordPress plugins & themes · reported by MITREMedium 6.1
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
Affected
1.0.61 to 1.0.61
What to do
Affects 1.0.61 to 1.0.61. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Aug 8, 2019admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletioCVE-2019-14773 · WordPress plugins & themes · reported by MITREHigh 7.5
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
Product
admin/includes/class.actions.snippet.php in the "Woody ad snippets
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update admin/includes/class.actions.snippet.php in the "Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Product
codection "Import users from CSV with meta
Fixed in
1.14.2.2
What to do
Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 8, 2019The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.CVE-2019-14682 · WordPress plugins & themes · reported by MITREMedium 4.3
The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
Product
acf-better-search (aka ACF: Better Search)
Fixed in
3.3.1
What to do
Update acf-better-search (aka ACF: Better Search) to 3.3.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 8, 2019The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.CVE-2019-14681 · WordPress plugins & themes · reported by MITREHigh 8.8
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
Product
Deny All Firewall
Fixed in
1.1.7
What to do
Update Deny All Firewall to 1.1.7 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.CVE-2019-14680 · WordPress plugins & themes · reported by MITREMedium 5.7
The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
Affected
3.2.1 to 3.2.1
What to do
Affects 3.2.1 to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Aug 8, 2019core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.CVE-2019-14679 · WordPress plugins & themes · reported by MITREMedium 6.5
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
Product
ARPrice Lite
Affected
2.2 to 2.2
What to do
Affects 2.2 to 2.2. Update ARPrice Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Jul 30, 2019The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.CVE-2019-13635 · WordPress plugins & themes · reported by MITRECritical 9.1
The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.
Product
WP Fastest Cache
Affected
up to 0.8.9.5
What to do
Affects up to 0.8.9.5. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jul 8, 2019The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.CVE-2019-13414 · WordPress plugins & themes · reported by MITREMedium 6.1
The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.
Product
Rencontre
Fixed in
3.1.3
What to do
Update Rencontre to 3.1.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 8, 2019The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.CVE-2019-13413 · WordPress plugins & themes · reported by MITRECritical 9.8
The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.
Product
Rencontre
Fixed in
3.1.3
What to do
Update Rencontre to 3.1.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.