Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
214 results · page 5 of 5
Jan 15, 2015Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to injCVE-2014-9570 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) datefilter parameter in the access_log page to wp-admin/users.php or (2) simple_security_ip_blacklist[] parameter in an add_blacklist_ip action in the ip_blacklist page to wp-admin/users.php.
- Product
- MyWebsiteAdvisor Simple Security
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update MyWebsiteAdvisor Simple Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comhtbridge.com
Dec 1, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Server-side request forgery (SSRF)CVE-2014-8749 · WordPress plugins & themes · reported by MITREMedium 5
Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.
- Product
- admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
- Affected
- up to .51
- What to do
- Affects up to .51. Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseclists.orgwordpress.org
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: SQL injectionCVE-2014-7959 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter.
- Product
- admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
- What to do
- Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Cross-site scripting (XSS)CVE-2014-7958 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost parameter.
- Product
- admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
- What to do
- Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Nov 6, 2014Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2014-4664 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.
- Product
- Cross-site scripting (XSS) vulnerability in the Wordfence Security
- Fixed in
- 5.1.4
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Wordfence Security to 5.1.4 or newer.
Full record and what to do →NVD recordhacktivity.websecgeeks.comsecurityfocus.com
Oct 2, 2014Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arCVE-2014-6242 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
- Product
- Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall
- Fixed in
- 3.8.3
- What to do
- Update Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall to 3.8.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Mar 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inCVE-2013-3487 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified HTML header fields to (1) 400.php, (2) 403.php, or (3) 403.php.
- What to do
- Update the plugin to the newest version.
Jul 8, 2013The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the CVE-2013-2205 · WordPress plugins & themes · reported by Red HatMedium 4.3
The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.
- Fixed in
- 3.5.2
- What to do
- Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgmake.wordpress.org
Aug 13, 2012bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for: Cross-site scripting (XSS)CVE-2012-4268 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_ACCEPT_ENCODING header.
- Product
- bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for
- What to do
- Update bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.orgplugins.trac.wordpress.org
Aug 13, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to iCVE-2012-4264 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "server variables," a different vulnerability than CVE-2012-4263.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security)
- Fixed in
- 3.2.5
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) to 3.2.5 or newer.
Full record and what to do →NVD recordbit51.complugins.trac.wordpress.org
Aug 13, 2012Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remoteCVE-2012-4263 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_USER_AGENT header.
- Product
- Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security)
- Fixed in
- 3.2.5
- What to do
- Update Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) to 3.2.5 or newer.
Full record and what to do →NVD recordbit51.compacketstormsecurity.org
Aug 10, 2011The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact CVE-2011-3129 · WordPress plugins & themes · reported by MITREHigh 9.3
The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact and attack vectors, possibly related to dangerous filenames.
- Fixed in
- 3.1.3
- What to do
- Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Aug 10, 2011Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."CVE-2011-3125 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."
- Fixed in
- 3.1.3
- What to do
- Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Aug 10, 2011Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."CVE-2011-3122 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."
- Fixed in
- 3.1.3
- What to do
- Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.