Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
225 results · page 5 of 5
Jun 1, 2021The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super CaCVE-2021-24312 · WordPress plugins & themes · reported by WPScanHigh 7.2
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
- Fixed in
- 1.7.3
- What to do
- Update the plugin to 1.7.3 or newer.
May 24, 2021Hotjar Connecticator: Is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textareaCVE-2021-24301 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users.
- Product
- Hotjar Connecticator
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Hotjar Connecticator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021Easy Contact Form Pro: Did not properly sanitise the text fields (suchCVE-2021-24168 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium privilege accounts (such as author and editor) to perform XSS attacks against high privilege ones like administrator.
- Product
- Easy Contact Form Pro
- Fixed in
- 1.1.1.9
- What to do
- Update Easy Contact Form Pro to 1.1.1.9 or newer.
Sep 20, 2019The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.CVE-2015-9400 · WordPress plugins & themes · reported by MITREHigh 8.8
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
- Product
- wordpress-meta-robots
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update wordpress-meta-robots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2019The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.CVE-2016-10981 · WordPress plugins & themes · reported by MITREMedium 6.1
The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.
- Product
- kento-post-view-counter
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update kento-post-view-counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgopenwall.com
Sep 10, 2019The examapp plugin 1.0 for WordPress has XSS via exam input text fields.CVE-2017-18601 · WordPress plugins & themes · reported by MITREMedium 5.4
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 10, 2019The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.CVE-2017-18600 · WordPress plugins & themes · reported by MITREMedium 5.4
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
- Product
- formcraft3
- Fixed in
- 3.4
- What to do
- Update formcraft3 to 3.4 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Aug 22, 2019The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.CVE-2009-5158 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.
- Product
- google-analyticator
- Fixed in
- 5.2.1
- What to do
- Update google-analyticator to 5.2.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.CVE-2015-9319 · WordPress plugins & themes · reported by MITREMedium 6.1
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
- Product
- gregs-high-performance-seo
- Fixed in
- 1.6.2
- What to do
- Update gregs-high-performance-seo to 1.6.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.CVE-2015-9304 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
- Product
- ultimate-member
- Fixed in
- 1.3.18
- What to do
- Update ultimate-member to 1.3.18 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Mar 5, 2019The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR MaCVE-2019-9574 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role.
- Product
- WP Human Resource Management
- Fixed in
- 2.2.6
- What to do
- Update WP Human Resource Management to 2.2.6 or newer.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 5, 2019In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text.CVE-2019-7413 · WordPress plugins & themes · reported by MITREMedium 6.1
In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. ("parallax" has a spelling change within the PHP filename.)
- Product
- In the Parallax Scroll (aka adamrob-parallax-scroll)
- Fixed in
- 2.1
- What to do
- Update In the Parallax Scroll (aka adamrob-parallax-scroll) to 2.1 or newer.
Full record and what to do →NVD recordmetamorfosec.complugins.trac.wordpress.org
Oct 3, 2018The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.CVE-2018-17947 · WordPress plugins & themes · reported by MITREMedium 6.1
The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.
- Product
- Snazzy Maps
- Fixed in
- 1.1.5
- What to do
- Update Snazzy Maps to 1.1.5 or newer.
Full record and what to do →NVD recorddefensecode.comseclists.org
Apr 30, 2018Image Alt & Title Text: Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS)CVE-2018-1000172 · WordPress plugins & themes · reported by MITREMedium 4.8
Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45.
- Product
- Image Alt & Title Text
- Affected
- up to 2.2.30
- Fixed in
- 2.2.45
- What to do
- Update Image Alt & Title Text to 2.2.45 or newer.
Full record and what to do →NVD recordfortiguard.comwordpress.org
Apr 23, 2018Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input fieldCVE-2018-10234 · WordPress plugins & themes · reported by MITREMedium 4.8
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options§ion=account page.
- Product
- Authenticated Cross site Scripting exists in the User Profile & Membership
- Fixed in
- 2.0.11
- What to do
- Update Authenticated Cross site Scripting exists in the User Profile & Membership to 2.0.11 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Jan 1, 2018The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter.CVE-2017-18011 · WordPress plugins & themes · reported by MITREMedium 6.1
The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter.
- Product
- MyCBGenie Affiliate Ads for Clickbank Products
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update MyCBGenie Affiliate Ads for Clickbank Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Oct 19, 2017WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging accessCVE-2012-6707 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org
Oct 2, 2017WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it CVE-2017-14990 · WordPress plugins & themes · reported by MITREMedium 6.5
WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecuritytracker.comcore.trac.wordpress.org
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remoCVE-2014-8604 · WordPress plugins & themes · reported by MITREMedium 5
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obtain sensitive information via unspecified vectors.
- Affected
- 3.1.1 to 3.1.1
- What to do
- Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapid.dhs.orgvapid.dhs.org
Nov 25, 2014the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3: Cross-site scripting (XSS)CVE-2014-9031 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post.
- Product
- the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3
- Fixed in
- 3.7.5
- What to do
- Update the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 to 3.7.5 or newer.
Full record and what to do →NVD recordadvisories.mageia.orgklikki.fi
Jul 2, 2014Cross-site scripting (XSS) vulnerability in settings/pwsettings.php in the Your Text Manager plugin 0.3.0 and earlier for WordPress allows remote attackers to iCVE-2014-4604 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in settings/pwsettings.php in the Your Text Manager plugin 0.3.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the ytmpw parameter.
- Product
- Your Text Manager
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update Your Text Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jun 2, 2014SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via uCVE-2014-3937 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- SQL injection vulnerability in the Contextual Related Posts
- Fixed in
- 1.8.10.2
- What to do
- Update SQL injection vulnerability in the Contextual Related Posts to 1.8.10.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jun 2, 2014Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentiCVE-2013-2710 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors.
- Product
- Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts
- Fixed in
- 1.8.7
- What to do
- Update Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts to 1.8.7 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Jan 23, 2013Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitraCVE-2011-4618 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
- Product
- Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget
- Fixed in
- 2.0.2
- What to do
- Update Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget to 2.0.2 or newer.
Full record and what to do →NVD recordarchives.neohapsis.complugins.trac.wordpress.org
Dec 31, 2004Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, textCVE-2004-1559 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.