Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

166 results · page 4 of 4

Aug 21, 2019The embed-comment-images plugin before 0.6 for WordPress has XSS.CVE-2017-18561 · WordPress plugins & themes · reported by MITREMedium 6.1
The embed-comment-images plugin before 0.6 for WordPress has XSS.
Product
embed-comment-images
Fixed in
0.6
What to do
Update embed-comment-images to 0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2019An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via tCVE-2019-14206 · WordPress plugins & themes · reported by MITREHigh 7.5
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php.
Product
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images
Fixed in
0.6.67
What to do
Update An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images to 0.6.67 or newer.
Full record and what to do →NVD record github.com markgruffer.github.io
Jul 21, 2019A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via theCVE-2019-14205 · WordPress plugins & themes · reported by MITREHigh 7.5
A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.
Product
A Local File Inclusion vulnerability in the Nevma Adaptive Images
Fixed in
0.6.67
What to do
Update A Local File Inclusion vulnerability in the Nevma Adaptive Images to 0.6.67 or newer.
Full record and what to do →NVD record github.com markgruffer.github.io
Jan 30, 2018admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, CVE-2018-6195 · WordPress plugins & themes · reported by MITREHigh 7.2
admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.
Product
admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images)
Fixed in
2.1.1
What to do
Update admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) to 2.1.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 30, 2018A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 foCVE-2018-6194 · WordPress plugins & themes · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php.
Fixed in
2.1.1
What to do
Update the plugin to 2.1.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 27, 2017Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbCVE-2015-7668 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter.
Product
Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map
Fixed in
1.3.0
What to do
Update Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map to 1.3.0 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php dCVE-2017-1002000 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content.
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
May 17, 2017Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redireCVE-2015-4070 · WordPress plugins & themes · reported by MITREMedium 6.1
Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Product
Wow Moodboard Lite
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update Wow Moodboard Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapid.dhs.org
Jul 8, 2015Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary CVE-2015-4616 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary files via a .. (dot dot) in the map_id parameter.
Product
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map
Fixed in
1.2.5
What to do
Update Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map to 1.2.5 or newer.
Full record and what to do →NVD record seclists.org securityfocus.com
Jan 28, 2015pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrCVE-2015-1376 · WordPress plugins & themes · reported by MITREMedium 4
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
Product
pixabay-images.php in the Pixabay Images
Fixed in
2.4
What to do
Update pixabay-images.php in the Pixabay Images to 2.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 28, 2015pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attaCVE-2015-1375 · WordPress plugins & themes · reported by MITREHigh 7.5
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.
Product
pixabay-images.php in the Pixabay Images
Fixed in
2.4
What to do
Update pixabay-images.php in the Pixabay Images to 2.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 27, 2015Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitraryCVE-2015-1366 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter.
Product
Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images
Fixed in
2.4
What to do
Update Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images to 2.4 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 27, 2015Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary fileCVE-2015-1365 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.
Product
Directory traversal vulnerability in pixabay-images.php in the Pixabay Images
Fixed in
2.4
What to do
Update Directory traversal vulnerability in pixabay-images.php in the Pixabay Images to 2.4 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
May 30, 2014popup.php in the Simple Popup Images plugin for: Cross-site scripting (XSS)CVE-2014-3921 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in popup.php in the Simple Popup Images plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the z parameter.
Product
popup.php in the Simple Popup Images plugin for
What to do
Update popup.php in the Simple Popup Images plugin for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 8, 2014Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated uCVE-2014-3123 · WordPress plugins & themes · reported by MITRELow 2.1
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
Product
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery
Fixed in
1.19.18
What to do
Update Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery to 1.19.18 or newer.
Full record and what to do →NVD record secunia.com securityfocus.com
Sep 30, 2013frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for: Unrestricted file uploadCVE-2013-5962 · WordPress plugins & themes · reported by MITREMedium 5.1
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
Product
frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for
Fixed in
3.3.4
What to do
Update frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for to 3.3.4 or newer.
Full record and what to do →NVD record archives.neohapsis.com codecanyon.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.