Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
194 results · page 4 of 4
Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1924 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfc_toolbar_save_settings_callback function. This makes it possible for unauthenticated attackers to change cache settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1923 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfc_remove_cdn_integration_ajax_request_callback function. This makes it possible for unauthenticated attackers to change cdn settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1922 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfc_pause_cdn_integration_ajax_request_callback function. This makes it possible for unauthenticated attackers to change cdn settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1921 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfc_start_cdn_integration_ajax_request_callback function. This makes it possible for unauthenticated attackers to change cdn settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1920 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfc_purgecache_varnish_callback function. This makes it possible for unauthenticated attackers to purge the varnish cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1919 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfc_preload_single_save_settings_callback function. This makes it possible for unauthenticated attackers to change cache-related settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1918 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfc_preload_single_callback function. This makes it possible for unauthenticated attackers to invoke a cache building action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized cache modificationCVE-2023-1338 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the attach_rule function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify cache rules.
- Product
- RapidLoad Power-Up for Autoptimize
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized cache modificationCVE-2023-1334 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the queue_posts function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify the plugin's cache.
- Product
- RapidLoad Power-Up for Autoptimize
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 23, 2022Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress.CVE-2022-36340 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress.
- Affected
- up to 1.2.49.0
- What to do
- Affects up to 1.2.49.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.complugins.svn.wordpress.org
Jul 11, 2022Cache Images: Does not implement nonce checksCVE-2022-2091 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload images via a CSRF attack.
- Product
- Cache Images
- Fixed in
- 3.2.1
- What to do
- Update Cache Images to 3.2.1 or newer.
Jun 13, 2022Hot Linked Image Cacher: Is vulnerable to CSRFCVE-2022-1765 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks (due to copyright violations or licensing rules).
- Product
- Hot Linked Image Cacher
- Affected
- up to 1.16
- What to do
- Affects up to 1.16. Update Hot Linked Image Cacher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 28, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, delete a source, createCVE-2022-29412 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, delete a source, create source.
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion.CVE-2022-25615 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion.
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jan 3, 2022OMGF | Host Google Fonts Locally: Does not validate the cache directory settingCVE-2021-25021 · WordPress plugins & themes · reported by WPScanMedium 4.9
The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
- Product
- OMGF | Host Google Fonts Locally
- Fixed in
- 4.5.12
- What to do
- Update OMGF | Host Google Fonts Locally to 4.5.12 or newer.
Jan 3, 2022CAOS | Host Google Analytics Locally: Does not validate the cache directory settingCVE-2021-25020 · WordPress plugins & themes · reported by WPScanMedium 4.9
The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
- Product
- CAOS | Host Google Analytics Locally
- Fixed in
- 4.1.9
- What to do
- Update CAOS | Host Google Analytics Locally to 4.1.9 or newer.
Jan 3, 2022LiteSpeed Cache: Does not properly verify that requests are coming from QUICCVE-2021-24964 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
- Product
- LiteSpeed Cache
- Fixed in
- 4.4.4
- What to do
- Update LiteSpeed Cache to 4.4.4 or newer.
Jan 3, 2022LiteSpeed Cache: Does not escape the qc_res parameter before outputting it back in the JS code of an admin pageCVE-2021-24963 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting
- Product
- LiteSpeed Cache
- Fixed in
- 4.4.4
- What to do
- Update LiteSpeed Cache to 4.4.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jul 19, 2021W3 Total Cache: Was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboardCVE-2021-24452 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
- Product
- W3 Total Cache
- Fixed in
- 2.1.5
- What to do
- Update W3 Total Cache to 2.1.5 or newer.
Jul 19, 2021W3 Total Cache: Was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboardCVE-2021-24436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
- Product
- W3 Total Cache
- Fixed in
- 2.1.4
- What to do
- Update W3 Total Cache to 2.1.4 or newer.
Jul 12, 2021W3 Total Cache: Did not sanitise or escape some of its CDN settingsCVE-2021-24427 · WordPress plugins & themes · reported by WPScanMedium 4.8
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- W3 Total Cache
- Fixed in
- 2.1.3
- What to do
- Update W3 Total Cache to 2.1.3 or newer.
Jun 1, 2021WP Super Cache: Did not properly sanitise its wp_cache_location parameter in its settingsCVE-2021-24329 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue.
- Product
- WP Super Cache
- Fixed in
- 1.7.3
- What to do
- Update WP Super Cache to 1.7.3 or newer.
Jun 1, 2021The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super CaCVE-2021-24312 · WordPress plugins & themes · reported by WPScanHigh 7.2
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
- Fixed in
- 1.7.3
- What to do
- Update the plugin to 1.7.3 or newer.
Apr 27, 2021WP Fastest Cache versions prior to 0.9.1.7: Directory traversalCVE-2021-20714 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in WP Fastest Cache versions prior to 0.9.1.7 allows a remote attacker with administrator privileges to delete arbitrary files on the server via unspecified vectors.
- Product
- WP Fastest Cache versions prior to 0.9.1.7
- Fixed in
- 0.9.1.7
- What to do
- Update WP Fastest Cache versions prior to 0.9.1.7 to 0.9.1.7 or newer.
Apr 5, 2021WP Super Cache: Was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location optionCVE-2021-24209 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
- Product
- WP Super Cache
- Fixed in
- 1.7.2
- What to do
- Update WP Super Cache to 1.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 25, 2020A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.CVE-2020-29172 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.
- Product
- A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache
- Fixed in
- 3.6.1
- What to do
- Update A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache to 3.6.1 or newer.
Full record and what to do →NVD recordwordpress.orglitespeedtech.com
Apr 30, 2020the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting: In affected versions of WordPress, aCVE-2020-11029 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
- Product
- the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting
- What to do
- Update the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting to the newest version.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 12, 2020WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution VulnerabilityCVE-2013-2010 · WordPress plugins & themes · reported by Red HatCritical 9.8
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Feb 7, 2020WordPress WP Super Cache Plugin 1.2 has Remote PHP Code ExecutionCVE-2013-2009 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution
- Affected
- 1.2 to 1.2
- What to do
- Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 7, 2020WordPress Super Cache Plugin 1.3 has XSS.CVE-2013-2008 · WordPress plugins & themes · reported by Red HatMedium 6.1
WordPress Super Cache Plugin 1.3 has XSS.
- Affected
- 1.3 to 1.3
- What to do
- Affects 1.3 to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comopenwall.com
Dec 26, 2019WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code.CVE-2013-2011 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009.
- Fixed in
- 1.3.2
- What to do
- Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Oct 17, 2019WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.CVE-2019-17673 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD recordblog.wpscan.orgcore.trac.wordpress.org
Aug 14, 2019The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameterCVE-2015-9316 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
- Product
- wp-fastest-cache
- Fixed in
- 0.8.4.9
- What to do
- Update wp-fastest-cache to 0.8.4.9 or newer.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jul 30, 2019The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.CVE-2019-13635 · WordPress plugins & themes · reported by MITRECritical 9.1
The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.
- Product
- WP Fastest Cache
- Affected
- up to 0.8.9.5
- What to do
- Affects up to 0.8.9.5. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Jul 29, 2019The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_foCVE-2019-6726 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header.
- Product
- WP Fastest Cache
- Affected
- up to 0.8.9.0
- What to do
- Affects up to 0.8.9.0. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.CVE-2018-17586 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.
- Affected
- 0.8.8.5 to 0.8.8.5
- What to do
- Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordansawaf.blogspot.comdocs.google.com
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter.CVE-2018-17585 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter.
- Affected
- 0.8.8.5 to 0.8.8.5
- What to do
- Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordansawaf.blogspot.comdocs.google.com
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page.CVE-2018-17584 · WordPress plugins & themes · reported by MITREHigh 8.8
The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page.
- Affected
- 0.8.8.5 to 0.8.8.5
- What to do
- Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordansawaf.blogspot.comdocs.google.com
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.CVE-2018-17583 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.
- Affected
- 0.8.8.5 to 0.8.8.5
- What to do
- Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordansawaf.blogspot.comdocs.google.com
Apr 1, 2019pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionCoCVE-2019-6715 · WordPress plugins & themes · reported by MITREHigh 7.5
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.
- Product
- pub/sns.php in the W3 Total Cache
- Fixed in
- 0.9.4
- What to do
- Update pub/sns.php in the W3 Total Cache to 0.9.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comvinhjaxt.github.io
Sep 19, 2017Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPreCVE-2015-4089 · WordPress plugins & themes · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.
- Fixed in
- 0.8.3.5
- What to do
- Update the plugin to 0.8.3.5 or newer.
Full record and what to do →NVD recordopenwall.comwordpress.org
Dec 24, 2014The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgerCVE-2014-9414 · WordPress plugins & themes · reported by MITREMedium 6.8
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the mobile_groups[*][redirect] parameter and an empty _wpnonce parameter in the w3tc_mobile page to wp-admin/admin.php.
- Product
- W3 Total Cache
- Fixed in
- 0.9.4.1
- What to do
- Update W3 Total Cache to 0.9.4.1 or newer.
Full record and what to do →NVD recordmazinahmed1.blogspot.compacketstormsecurity.com
Dec 19, 2014Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to injecCVE-2014-8724 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the default URI.
- Product
- Cross-site scripting (XSS) vulnerability in the W3 Total Cache
- Fixed in
- 0.9.4.1
- What to do
- Update Cross-site scripting (XSS) vulnerability in the W3 Total Cache to 0.9.4.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Feb 12, 2013Cross-site scripting (XSS) vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrCVE-2011-5265 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter. NOTE: this has been disputed by a third party.
- Product
- Featurific For
- What to do
- Update Featurific For to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.