Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

2,200 results · page 42 of 44

Aug 29, 2019The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15774 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-booking
Fixed in
2.5
What to do
Update nd-booking to 2.5 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15773 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-travel
Fixed in
1.7
What to do
Update nd-travel to 1.7 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15772 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-donations
Fixed in
1.4
What to do
Update nd-donations to 1.4 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 28, 2019The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.CVE-2015-9355 · WordPress plugins & themes · reported by MITREMedium 6.1
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Product
two-factor-authentication
Fixed in
1.1.10
What to do
Update two-factor-authentication to 1.1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.CVE-2019-15647 · WordPress plugins & themes · reported by MITREHigh 8.8
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
Product
groundhogg
Fixed in
1.3.5
What to do
Update groundhogg to 1.3.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-15322 · WordPress plugins & themes · reported by MITRECritical 9.8
The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.
Product
shortcode-factory
Fixed in
2.8
What to do
Update shortcode-factory to 2.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.CVE-2019-15320 · WordPress plugins & themes · reported by MITRECritical 9.8
The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.
Product
option-tree
Fixed in
2.7.3
What to do
Update option-tree to 2.7.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.CVE-2017-18584 · WordPress plugins & themes · reported by MITREHigh 7.5
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
Product
post-pay-counter
Fixed in
2.731
What to do
Update post-pay-counter to 2.731 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.CVE-2015-9337 · WordPress plugins & themes · reported by MITREHigh 7.5
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Product
profile-builder
Fixed in
2.1.4
What to do
Update profile-builder to 2.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.CVE-2018-20979 · WordPress plugins & themes · reported by MITRECritical 9.8
The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.
Product
contact-form-7
Fixed in
5.0.4
What to do
Update contact-form-7 to 5.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.CVE-2013-7481 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
3.3.5
What to do
Update contact-form-plugin to 3.3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.CVE-2016-10891 · WordPress plugins & themes · reported by MITREMedium 6.1
The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
Product
aryo-activity-log
Fixed in
2.3.3
What to do
Update aryo-activity-log to 2.3.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.CVE-2016-10890 · WordPress plugins & themes · reported by MITREMedium 6.1
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
Product
aryo-activity-log
Fixed in
2.3.2
What to do
Update aryo-activity-log to 2.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.CVE-2016-10909 · WordPress plugins & themes · reported by MITRECritical 9.8
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.CVE-2016-10908 · WordPress plugins & themes · reported by MITREMedium 6.1
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.CVE-2015-9321 · WordPress plugins & themes · reported by MITREMedium 6.1
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Product
shortcode-factory
Fixed in
1.1.1
What to do
Update shortcode-factory to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.CVE-2015-9332 · WordPress plugins & themes · reported by MITREMedium 6.5
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Product
uninstall
Fixed in
1.2
What to do
Update uninstall to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultCVE-2019-14788 · WordPress plugins & themes · reported by MITREHigh 8.8
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
Product
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters
Fixed in
4.6.19
What to do
Update wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.CVE-2019-14784 · WordPress plugins & themes · reported by MITREMedium 6.1
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
Product
CP Contact Form with PayPal
Fixed in
1.2.98
What to do
Update CP Contact Form with PayPal to 1.2.98 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked CVE-2019-14795 · WordPress plugins & themes · reported by MITREMedium 4.8
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,CVE-2019-14790 · WordPress plugins & themes · reported by MITREMedium 6.1
The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameterCVE-2015-9316 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Product
wp-fastest-cache
Fixed in
0.8.4.9
What to do
Update wp-fastest-cache to 0.8.4.9 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Aug 13, 2019The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.CVE-2018-20964 · WordPress plugins & themes · reported by MITREHigh 8.8
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
Product
contact-form-to-email
Fixed in
1.2.66
What to do
Update contact-form-to-email to 1.2.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.CVE-2018-20963 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.
Product
contact-form-to-email
Fixed in
1.2.66
What to do
Update contact-form-to-email to 1.2.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.CVE-2017-18492 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
Product
contact-form-to-db
Fixed in
1.5.7
What to do
Update contact-form-to-db to 1.5.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.CVE-2017-18491 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
Product
contact-form-plugin
Fixed in
4.0.6
What to do
Update contact-form-plugin to 4.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.CVE-2017-18490 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
Product
contact-form-multi
Fixed in
1.2.1
What to do
Update contact-form-multi to 1.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.CVE-2017-18489 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
Product
contact-form-7-sms-addon
Fixed in
2.4.0
What to do
Update contact-form-7-sms-addon to 2.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.CVE-2016-10869 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
4.0.2
What to do
Update contact-form-plugin to 4.0.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 3.96 for WordPress has XSS.CVE-2015-9295 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
3.96
What to do
Update contact-form-plugin to 3.96 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 3.52 for WordPress has XSS.CVE-2013-7475 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
3.52
What to do
Update contact-form-plugin to 3.52 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=CVE-2019-14798 · WordPress plugins & themes · reported by MITREMedium 4.9
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
Product
10Web Photo Gallery
Fixed in
1.5.25
What to do
Update 10Web Photo Gallery to 1.5.25 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?actioCVE-2019-14796 · WordPress plugins & themes · reported by MITREMedium 5.4
The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.CVE-2019-14793 · WordPress plugins & themes · reported by MITREMedium 6.5
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
Product
Meta Box
Fixed in
4.16.3
What to do
Update Meta Box to 4.16.3 or newer.
Full record and what to do →NVD record metabox.io pluginvulnerabilities.com
Aug 9, 2019The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameterCVE-2019-14787 · WordPress plugins & themes · reported by MITREMedium 5.4
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
Product
Tribulant Newsletters
Fixed in
4.6.19
What to do
Update Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.phpCVE-2019-14785 · WordPress plugins & themes · reported by MITREMedium 5.4
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
Product
CP Contact Form with PayPal
Fixed in
1.2.99
What to do
Update CP Contact Form with PayPal to 1.2.99 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletioCVE-2019-14773 · WordPress plugins & themes · reported by MITREHigh 7.5
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
Product
admin/includes/class.actions.snippet.php in the "Woody ad snippets
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update admin/includes/class.actions.snippet.php in the "Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Product
codection "Import users from CSV with meta
Fixed in
1.14.2.2
What to do
Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 5, 2019The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?actioCVE-2019-14348 · WordPress plugins & themes · reported by MITRECritical 9.8
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter.
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
May 13, 2019The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or CVE-2018-18872 · WordPress plugins & themes · reported by MITREMedium 5.4
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI.
Product
Kieran O'Shea Calendar
Fixed in
1.3.11
What to do
Update Kieran O'Shea Calendar to 1.3.11 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
May 7, 2019Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated).CVE-2019-10869 · WordPress plugins & themes · reported by MITREHigh 8.1
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
Product
Path Traversal and Unrestricted File Upload exists in the Ninja Forms
Fixed in
3.0.23
What to do
Update Path Traversal and Unrestricted File Upload exists in the Ninja Forms to 3.0.23 or newer.
Full record and what to do →NVD record wpscan.com wpvulndb.com
May 6, 2019The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_defaulCVE-2019-11807 · WordPress plugins & themes · reported by MITREHigh 7.5
The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_default_keys_load parameter because of a nopriv_ registration and a lack of capabilities checks.
Product
WooCommerce Checkout Manager
Fixed in
4.3
What to do
Update WooCommerce Checkout Manager to 4.3 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Apr 29, 2019The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion CVE-2019-11591 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form
Fixed in
1.13.5
What to do
Update WebDorado Contact Form to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 29, 2019The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via diCVE-2019-11590 · WordPress plugins & themes · reported by MITREHigh 8.8
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
10Web Form Maker
Fixed in
1.13.5
What to do
Update 10Web Form Maker to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 26, 2019The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inCVE-2019-11557 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form Builder
Fixed in
1.0.69
What to do
Update WebDorado Contact Form Builder to 1.0.69 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.CVE-2018-17586 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.
Affected
0.8.8.5 to 0.8.8.5
What to do
Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.CVE-2018-17583 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.
Affected
0.8.8.5 to 0.8.8.5
What to do
Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template.CVE-2018-16257 · WordPress plugins & themes · reported by MITREMedium 6.1
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Mar 21, 2019The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.CVE-2019-9914 · WordPress plugins & themes · reported by MITREMedium 6.1
The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.
Product
yop-poll
Fixed in
6.0.3
What to do
Update yop-poll to 6.0.3 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.