Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
243 results · page 5 of 5
May 30, 2023AnyWhere Elementor: Discloses a Freemius Secret KeyCVE-2023-0443 · WordPress plugins & themes · reported by WPScanMedium 5.3
The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.
- Product
- AnyWhere Elementor
- Fixed in
- 1.2.8
- What to do
- Update AnyWhere Elementor to 1.2.8 or newer.
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.4.3 versions.CVE-2023-23813 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.4.3 versions.
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 15, 2023tagDiv Composer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-1596 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- tagDiv Composer
- Fixed in
- 4.0
- What to do
- Update tagDiv Composer to 4.0 or newer.
Apr 17, 2023Pricing Tables For WPBakery Page Builder (formerly Visual Composer): Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2023-1274 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
- Product
- Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
- Fixed in
- 3.0
- What to do
- Update Pricing Tables For WPBakery Page Builder (formerly Visual Composer) to 3.0 or newer.
Apr 17, 2023Pricing Tables For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0367 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
- Fixed in
- 3.0
- What to do
- Update Pricing Tables For WPBakery Page Builder (formerly Visual Composer) to 3.0 or newer.
Apr 16, 2023Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.CVE-2023-22687 · WordPress plugins & themes · reported by PatchstackLow 3.7
Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.
- Affected
- up to 1.9.4.0
- What to do
- Affects up to 1.9.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 15, 2023Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.3.24.1 versions.CVE-2022-47427 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.3.24.1 versions.
- Affected
- up to 3.3.24.1
- What to do
- Affects up to 3.3.24.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions.CVE-2022-47440 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions.
- Affected
- up to 1.9.10
- What to do
- Affects up to 1.9.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 21, 2023Page Builder: Live Composer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4669 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Page Builder: Live Composer
- Fixed in
- 1.5.23
- What to do
- Update Page Builder: Live Composer to 1.5.23 or newer.
Jan 23, 2023Mongoose Page: Does not validate and escape one of its shortcode attributesCVE-2022-4675 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Mongoose Page
- Fixed in
- 1.9.0
- What to do
- Update Mongoose Page to 1.9.0 or newer.
Nov 21, 2022DeepL Pro API translation: Discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an externalCVE-2022-3691 · WordPress plugins & themes · reported by WPScanHigh 7.5
The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.
- Product
- DeepL Pro API translation
- Fixed in
- 1.7.5
- What to do
- Update DeepL Pro API translation to 1.7.5 or newer.
Nov 14, 2022tagDiv Composer WordPress plugin before 3.5, required by the Newspaper: And Newsmag WordPress theme before 5CVE-2022-3477 · WordPress plugins & themes · reported by WPScanCritical 9.8
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
- Product
- tagDiv Composer WordPress plugin before 3.5, required by the Newspaper
- Fixed in
- 3.5
- What to do
- Update tagDiv Composer WordPress plugin before 3.5, required by the Newspaper to 3.5 or newer.
Sep 6, 2022Visual Composer Website Builder: Stored Cross-Site ScriptingCVE-2022-2516 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Visual Composer Website Builder
- Affected
- up to 45.0
- What to do
- Affects up to 45.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2022Visual Composer Website Builder: Stored Cross-Site ScriptingCVE-2022-2430 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Visual Composer Website Builder
- Affected
- up to 45.0
- What to do
- Affects up to 45.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 5, 2022The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticatedCVE-2022-2376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
- Product
- Directorist
- Fixed in
- 7.3.1
- What to do
- Update Directorist to 7.3.1 or newer.
Aug 22, 2022Duplicator: Discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the pluginCVE-2022-2551 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
- Product
- Duplicator
- Fixed in
- 1.4.7
- What to do
- Update Duplicator to 1.4.7 or newer.
Aug 22, 2022Transposh WordPress Translation: Exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/adminCVE-2022-25810 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and backup/restore operations.
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Very Simple Contact Form: Exposes the solution to the captcha in the rendered contact formCVE-2022-1801 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.
- Product
- Very Simple Contact Form
- Fixed in
- 11.6
- What to do
- Update Very Simple Contact Form to 11.6 or newer.
Jun 8, 2022FiboSearch: Does not sanitise and escape some of its settingsCVE-2022-1469 · WordPress plugins & themes · reported by WPScanMedium 4.8
The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- FiboSearch
- Fixed in
- 1.17.0
- What to do
- Update FiboSearch to 1.17.0 or newer.
Apr 19, 2022The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API routeCVE-2022-1186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 4, 2022KingComposer: Does not have authorisationCVE-2021-25048 · WordPress plugins & themes · reported by WPScanMedium 5.4
The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them
- Product
- KingComposer
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 21, 2022Amelia: Stores image blobs into actual files whose extension is controlled by the userCVE-2022-0687 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
- Product
- Amelia
- Fixed in
- 1.0.47
- What to do
- Update Amelia to 1.0.47 or newer.
Mar 14, 2022The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX actCVE-2022-0165 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
- Product
- Page Builder KingComposer
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update Page Builder KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2022Product Feed PRO for WooCommerce: Does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user)CVE-2022-0426 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- Product
- Product Feed PRO for WooCommerce
- Fixed in
- 11.2.3
- What to do
- Update Product Feed PRO for WooCommerce to 11.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022CorreosExpress: Generates log filesCVE-2021-25009 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses
- Product
- CorreosExpress
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update CorreosExpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints wCVE-2021-25118 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 29, 2021The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site uCVE-2021-39342 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8.
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 30, 2021Business Hours Indicator: Does not sanitise or escape its 'Now closed message" settingCVE-2021-24593 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue
- Product
- Business Hours Indicator
- Fixed in
- 2.3.5
- What to do
- Update Business Hours Indicator to 2.3.5 or newer.
Aug 9, 2021Marmoset Viewer: Does not property sanitizeCVE-2021-24495 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.
- Product
- Marmoset Viewer
- Fixed in
- 1.9.3
- What to do
- Update Marmoset Viewer to 1.9.3 or newer.
Full record and what to do →NVD recordjohnjhacking.comwpscan.com
May 24, 2021The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilCVE-2021-24307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.
- Fixed in
- 4.1.0.2
- What to do
- Update the plugin to 4.1.0.2 or newer.
May 6, 2021An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low prCVE-2021-24244 · WordPress plugins & themes · reported by WPScanMedium 6.5
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).
- Fixed in
- 4.5.8
- What to do
- Update the plugin to 4.5.8 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
May 6, 2021An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitizationCVE-2021-24243 · WordPress plugins & themes · reported by WPScanMedium 5.4
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.
- Fixed in
- 4.5.6
- What to do
- Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Jul 9, 2020A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submiCVE-2020-15299 · WordPress plugins & themes · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is executed in the victim's browser.
- Product
- A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Mar 14, 2020The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison.CVE-2020-10568 · WordPress plugins & themes · reported by MITREHigh 8.8
The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.
- Product
- sitepress-multilingual-cms (WPML)
- Fixed in
- 4.3.7-b.2
- What to do
- Update sitepress-multilingual-cms (WPML) to 4.3.7-b.2 or newer.
Full record and what to do →NVD recordmedium.comwpvulndb.com
Sep 13, 2019The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.CVE-2016-10954 · WordPress plugins & themes · reported by MITRECritical 9.8
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
- Product
- Neosense
- Fixed in
- 1.8
- What to do
- Update Neosense to 1.8 or newer.
Full record and what to do →NVD recordlifeforms.nlwpvulndb.com
Sep 4, 2019cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_desCVE-2019-14470 · WordPress plugins & themes · reported by MITREMedium 6.1
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
- Product
- cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro
- Affected
- up to 4.9.32
- What to do
- Affects up to 4.9.32. Update cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 8, 2019admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletioCVE-2019-14773 · WordPress plugins & themes · reported by MITREHigh 7.5
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
- Product
- admin/includes/class.actions.snippet.php in the "Woody ad snippets
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update admin/includes/class.actions.snippet.php in the "Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Mar 21, 2019The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.CVE-2019-9910 · WordPress plugins & themes · reported by MITREMedium 6.1
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.
- Affected
- 2.7.6 to 2.7.6
- What to do
- Affects 2.7.6 to 2.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseclists.orglists.openwall.net
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen.CVE-2018-20151 · WordPress plugins & themes · reported by MITREHigh 7.5
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
- Fixed in
- 4.9.9
- What to do
- Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD recordsecurityfocus.comcodex.wordpress.org
Sep 27, 2017Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.CVE-2017-14842 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 14, 2017wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier foCVE-2017-5493 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
- Fixed in
- 4.7.1
- What to do
- Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD recorddebian.orgopenwall.com
Mar 19, 2009the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU: Cross-site scripting (XSS)CVE-2009-1030 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
- Product
- the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU
- Fixed in
- 2.7
- What to do
- Update the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU to 2.7 or newer.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jul 6, 2006WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-contentCVE-2006-3390 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.