Vulnerability database

167 results · page 4 of 4

• Aug 10, 2018In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files.CVE-2018-14028 · WordPress plugins & themes · reported by MITREHigh 7.2

  In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does have the required capabilities for plugin uploads) cannot simply place arbitrary PHP code into a valid plugin ZIP file and upload that plugin, because a machine's wp-content/plugins directory permissions were set up to block all new plugins.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordsecurityfocus.comcore.trac.wordpress.org

• Jun 26, 2018WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker cCVE-2018-1000556 · WordPress plugins & themes · reported by MITREMedium 6.1

  WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacker must craft an URL with payload and send to the user. Victim need to open the link to be affected by reflected XSS. .

  Fixed in

  12.0.6

  What to do

  Update the plugin to 12.0.6 or newer.

  Full record and what to do →NVD recordpluginvulnerabilities.compluginvulnerabilities.com

• Nov 29, 2017The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, whicCVE-2017-17058 · WordPress plugins & themes · reported by MITREHigh 7.5

  The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template files have "if (!defined('ABSPATH')) {exit;}" code

  Product

  WooCommerce

  Affected

  up to 3.x

  What to do

  Affects up to 3.x. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comexploit-db.com

• Nov 28, 2017The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templCVE-2017-17043 · WordPress plugins & themes · reported by MITREMedium 6.1

  The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.

  Affected

  1.0.0 to 1.0.0

  What to do

  Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Nov 17, 2017The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/adCVE-2017-16871 · WordPress plugins & themes · reported by MITREHigh 8.1

  The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary

  Product

  UpdraftPlus

  Affected

  up to 1.13.12

  What to do

  Affects up to 1.13.12. Update UpdraftPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Nov 17, 2017The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget sCVE-2017-16870 · WordPress plugins & themes · reported by MITREHigh 8.1

  The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary

  Product

  UpdraftPlus

  Affected

  up to 1.13.12

  What to do

  Affects up to 1.13.12. Update UpdraftPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jun 8, 2017The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to readCVE-2015-3634 · WordPress plugins & themes · reported by MITREHigh 7.5

  The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.

  Product

  SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8

  Affected

  up to 2.2.21

  What to do

  Affects up to 2.2.21. Update SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordopenwall.comsecurityfocus.com

• Mar 11, 2017In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.CVE-2017-6816 · WordPress plugins & themes · reported by MITREMedium 4.9

  In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.

  Fixed in

  4.7.3

  What to do

  Update the plugin to 4.7.3 or newer.

  Full record and what to do →NVD recorddebian.orgsecurityfocus.com

• Jan 18, 2017The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_pluginsCVE-2016-10148 · WordPress plugins & themes · reported by MITREMedium 4.3

  The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.

  Fixed in

  4.6

  What to do

  Update the plugin to 4.6 or newer.

  Full record and what to do →NVD recordopenwall.comsecurityfocus.com

• Dec 2, 2014Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 aCVE-2014-9178 · WordPress plugins & themes · reported by MITREHigh 7.5

  Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com

• Jul 2, 2014Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPress allows remote attaCVE-2014-4593 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filter parameter.

  Product

  WP Plugin Manager (wppm)

  Affected

  up to 1.6.4.b

  What to do

  Affects up to 1.6.4.b. Update WP Plugin Manager (wppm) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• Jan 20, 2014wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML: Cross-site scripting (XSS)CVE-2010-5295 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.

  Product

  wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML

  Fixed in

  3.0.2

  What to do

  Update wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML to 3.0.2 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org

• Sep 14, 2012wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a nCVE-2012-4422 · WordPress plugins & themes · reported by Red HatLow 3.5

  wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.

  Fixed in

  3.4.2

  What to do

  Update the plugin to 3.4.2 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org

• Apr 21, 2012wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-widCVE-2012-2402 · WordPress plugins & themes · reported by MITREMedium 5.5

  wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgosvdb.org

• Nov 3, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject aCVE-2010-3977 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordsecunia.comconviso.com.br

• Nov 3, 2006Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitraCVE-2006-5705 · WordPress plugins & themes · reported by MITREMedium 6

  Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via directory traversal sequences in the (1) backup and (2) fragment parameters in a GET request.

  Fixed in

  2.0.5

  What to do

  Update the plugin to 2.0.5 or newer.

  Full record and what to do →NVD recordbugs.gentoo.orgmarkjaquith.wordpress.com

• Dec 21, 2005WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-content/plugins/hello.phCVE-2005-4463 · WordPress plugins & themes · reported by MITREMedium 5

  WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-content/plugins/hello.php, (3) wp-admin/upgrade-functions.php, (4) wp-admin/edit-form.php, (5) wp-settings.php, and (6) wp-admin/edit-form-comment.php, which leaks the path in an error message related to undefined functions or failed includes. NOTE: the wp-admin/menu-header.php vector is already covered by CVE-2005-2110. NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors were also reported to affect WordPress 2.0.1.

  Fixed in

  1.5.2

  What to do

  Update the plugin to 1.5.2 or newer.

  Full record and what to do →NVD recordneosecurityteam.netecho.or.id

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.