Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

1,993 results · page 38 of 40

Oct 8, 2012PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP CVE-2011-4342 · WordPress plugins & themes · reported by Red HatHigh 7.5
PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.
Product
PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup
Fixed in
1.7.2
What to do
Update PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup to 1.7.2 or newer.
Full record and what to do →NVD record packetstormsecurity.org seclists.org
Oct 8, 2012Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute CVE-2012-5318 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the directory specified by the folder parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1125.
Product
Kish Guest Posting
What to do
Update Kish Guest Posting to the newest version.
Full record and what to do →NVD record secunia.com openwall.com
Oct 8, 2012SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vCVE-2012-5310 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
SQL injection vulnerability in the WP e-Commerce
Fixed in
3.8.7.6
What to do
Update SQL injection vulnerability in the WP e-Commerce to 3.8.7.6 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Oct 8, 2012Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to eCVE-2012-1125 · WordPress plugins & themes · reported by Red HatMedium 6.8
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
Product
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting
Fixed in
1.2
What to do
Update Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting to 1.2 or newer.
Full record and what to do →NVD record archives.neohapsis.com plugins.svn.wordpress.org
Oct 1, 2012Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via thCVE-2012-4242 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page.
Product
MF Gig Calendar
What to do
Update MF Gig Calendar to the newest version.
Full record and what to do →NVD record reactionpenetrationtesting.co.uk securityfocus.com
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers CVE-2011-5194 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter, a different vulnerability than CVE-2011-5193.
Product
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search
Fixed in
1.4.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search to 1.4.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Sep 23, 2012Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary webCVE-2011-5192 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5191.
Product
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite
Fixed in
1.5.6
What to do
Update Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite to 1.5.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Sep 23, 2012Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.4 for WordPress allows remote attackers to inject arbitrary webCVE-2011-5191 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5192.
Product
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite
Fixed in
1.5.4
What to do
Update Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite to 1.5.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 20, 2012Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitCVE-2011-5182 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input, and because that input is never sent to the browser, an attacker has no way of executing script or code on a user's behalf.
Product
Lanoba Social
What to do
Update Lanoba Social to the newest version.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Sep 20, 2012Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web scriCVE-2011-5180 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information. NOTE: this has been disputed by a third party.
Product
ZooEffect
What to do
Update ZooEffect to the newest version.
Full record and what to do →NVD record osvdb.org securityfocus.com
Sep 14, 2012The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticateCVE-2012-4421 · WordPress plugins & themes · reported by Red HatMedium 4
The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.
Fixed in
3.4.2
What to do
Update the plugin to 3.4.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Sep 14, 2012The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users toCVE-2010-5106 · WordPress plugins & themes · reported by Red HatMedium 6.5
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.
Fixed in
3.0.3
What to do
Update the plugin to 3.0.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Aug 29, 2012Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to injecCVE-2011-4926 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Product
Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize
Fixed in
1.7.22
What to do
Update Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize to 1.7.22 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 23, 2012Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject aCVE-2011-5106 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type
Fixed in
0.1.7
What to do
Update Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type to 0.1.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 14, 2012The ShareYourCart plugin 1.7.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors related to the SDK.CVE-2012-4332 · WordPress plugins & themes · reported by MITREMedium 5
The ShareYourCart plugin 1.7.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors related to the SDK.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 14, 2012Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.CVE-2012-4327 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.
Product
Unspecified vulnerability in the Image News slider
Fixed in
3.3
What to do
Update Unspecified vulnerability in the Image News slider to 3.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 13, 2012Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTCVE-2012-4283 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter.
Product
Cross-site scripting (XSS) vulnerability in the Login With Ajax
Fixed in
3.0.4.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Login With Ajax to 3.0.4.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 13, 2012Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to injectCVE-2012-4273 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.
Product
Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons
Fixed in
0.34
What to do
Update Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons to 0.34 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Aug 13, 2012Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remoteCVE-2012-4263 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_USER_AGENT header.
Product
Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security)
Fixed in
3.2.5
What to do
Update Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) to 3.2.5 or newer.
Full record and what to do →NVD record bit51.com packetstormsecurity.org
Aug 13, 2012Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2012-2371 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.
Product
WP-FaceThumb
What to do
Update WP-FaceThumb to the newest version.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jul 22, 2012WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain CVE-2012-3385 · WordPress plugins & themes · reported by Red HatMedium 5
WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.
Fixed in
3.4.1
What to do
Update the plugin to 3.4.1 or newer.
Full record and what to do →NVD record codex.wordpress.org openwall.com
Jun 27, 2012Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code CVE-2012-3814 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in font-uploader/fonts.
Product
Font Uploader
What to do
Update Font Uploader to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 19, 2012Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-3588 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.
Product
Plugin Newsletter
What to do
Update Plugin Newsletter to the newest version.
Full record and what to do →NVD record secunia.com exploit-db.com
Jun 16, 2012Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbiCVE-2012-3578 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in html/images.
Product
FCChat Widget
Affected
up to 2.2.13.1
What to do
Affects up to 2.2.13.1. Update FCChat Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jun 16, 2012Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbiCVE-2012-3577 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/user_uploads.
Product
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation
Fixed in
1.4
What to do
Update Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation to 1.4 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jun 15, 2012Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary codeCVE-2012-3576 · WordPress plugins & themes · reported by MITREHigh 10
Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/wpstorecart.
Product
Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart
Fixed in
2.5.30
What to do
Update Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart to 2.5.30 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jun 15, 2012Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploadinCVE-2012-3575 · WordPress plugins & themes · reported by MITREHigh 10
Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/rbxslider.
Product
RBX Gallery
What to do
Update RBX Gallery to the newest version.
Full record and what to do →NVD record secunia.com exploit-db.com
Jun 15, 2012Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script CVE-2012-2633 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
Product
Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp
Fixed in
1.8.3.1
What to do
Update Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp to 1.8.3.1 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
May 22, 2012Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote aCVE-2012-2759 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php.
Product
Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax)
Fixed in
3.0.4.1
What to do
Update Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) to 3.0.4.1 or newer.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
May 21, 2012Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows rCVE-2012-2920 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo
Fixed in
0.9.5.2
What to do
Update Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo to 0.9.5.2 or newer.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
May 21, 2012Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2012-2917 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.
Product
Share and Follow
What to do
Update Share and Follow to the newest version.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
May 21, 2012Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-2916 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the active_option parameter to wp-admin/tools.php.
Product
Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE
Fixed in
2.1
What to do
Update Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE to 2.1 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Apr 21, 2012wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-widCVE-2012-2402 · WordPress plugins & themes · reported by MITREMedium 5.5
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org osvdb.org
Mar 19, 2012The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknoCVE-2012-1786 · WordPress plugins & themes · reported by MITREMedium 5
The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
Product
Media Upload form in the Video Embed & Thumbnail Generator
Fixed in
2.0
What to do
Update Media Upload form in the Video Embed & Thumbnail Generator to 2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 19, 2012kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecifiedCVE-2012-1785 · WordPress plugins & themes · reported by MITREHigh 7.5
kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
Product
kg_callffmpeg.php in the Video Embed & Thumbnail Generator
Fixed in
2.0
What to do
Update kg_callffmpeg.php in the Video Embed & Thumbnail Generator to 2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Mar 19, 2012Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-5082 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
Product
s2Member Pro
Fixed in
111220
What to do
Update s2Member Pro to 111220 or newer.
Full record and what to do →NVD record secunia.com primothemes.com
Feb 24, 2012PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary CVE-2012-1205 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
Product
PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload
Fixed in
0.20
What to do
Update PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload to 0.20 or newer.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers CVE-2012-1068 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
Product
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments
Fixed in
2.0.7
What to do
Update Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments to 2.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Feb 14, 2012SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter iCVE-2012-1067 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
WP-RecentComments
What to do
Update WP-RecentComments to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Feb 7, 2012actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP codCVE-2012-1011 · WordPress plugins & themes · reported by MITREHigh 7.5
actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Product
AllWebMenus
What to do
Update AllWebMenus to the newest version.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Feb 7, 2012Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP codeCVE-2012-1010 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Product
Unrestricted file upload vulnerability in actions.php in the AllWebMenus
Fixed in
1.1.8
What to do
Update Unrestricted file upload vulnerability in actions.php in the AllWebMenus to 1.1.8 or newer.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Jan 20, 2012Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-0898 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.
Product
myEASYbackup
What to do
Update myEASYbackup to the newest version.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 20, 2012Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files viaCVE-2012-0896 · WordPress plugins & themes · reported by MITREMedium 5
Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
Product
Absolute path traversal vulnerability in download.php in the Count Per Day module
Fixed in
3.1.1
What to do
Update Absolute path traversal vulnerability in download.php in the Count Per Day module to 3.1.1 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Jan 20, 2012Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-0895 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter.
Product
Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module
Fixed in
3.1.1
What to do
Update Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module to 3.1.1 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Dec 27, 2011Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers toCVE-2011-3841 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.
Product
Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium
Fixed in
11.12.08
What to do
Update Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium to 11.12.08 or newer.
Full record and what to do →NVD record secunia.com secunia.com
Nov 30, 2011SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote aCVE-2011-4646 · WordPress plugins & themes · reported by MITREMedium 6
SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post. NOTE: some of these details are obtained from third party information.
Product
SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions
Fixed in
1.62
What to do
Update SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions to 1.62 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Nov 29, 2011Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrCVE-2011-4568 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.
Product
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer
Fixed in
1.2.12
What to do
Update Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer to 1.2.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Oct 7, 2011Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote CVE-2010-4875 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.
Product
Vodpod Video Gallery
What to do
Update Vodpod Video Gallery to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Oct 4, 2011PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via aCVE-2011-3981 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
Product
Allwebmenus
What to do
Update Allwebmenus to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-3865 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Product
Cross-site scripting (XSS) vulnerability in the Black-LetterHead
Fixed in
1.6
What to do
Update Cross-site scripting (XSS) vulnerability in the Black-LetterHead to 1.6 or newer.
Full record and what to do →NVD record sitewat.ch sitewat.ch

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.