Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,546 results · page 50 of 51

May 12, 2008wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypasCVE-2008-2146 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record osvdb.org trac.wordpress.org
Apr 30, 2008wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for: SQL injectionCVE-2008-2034 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for
What to do
Update wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Apr 27, 2008ss_load.php in the Spreadsheet: SQL injectionCVE-2008-1982 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.
Product
ss_load.php in the Spreadsheet
Affected
up to 0.6
What to do
Affects up to 0.6. Update ss_load.php in the Spreadsheet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com timrohrer.com
Apr 2, 2008wp-download.php in the WP-Download 1.2 plugin for: SQL injectionCVE-2008-1646 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the dl_id parameter.
Product
wp-download.php in the WP-Download 1.2 plugin for
What to do
Update wp-download.php in the WP-Download 1.2 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Feb 28, 2008modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for: Eval injectionCVE-2008-1060 · WordPress plugins & themes · reported by MITREHigh 7.5
Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text parameter.
Product
modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for
What to do
Update modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 28, 2008modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for: PHP remote file inclusionCVE-2008-1059 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.
Product
modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for
What to do
Update modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 25, 2008Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL CVE-2008-0939 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the photo parameter to index.php, used by the wppa_photo_name function; or (2) the album parameter to index.php, used by the wppa_album_name function. NOTE: some of these details are obtained from third party information.
Fixed in
1.1
What to do
Update the plugin to 1.1 or newer.
Full record and what to do →NVD record me.mywebsight.ws secunia.com
Feb 20, 2008wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for: SQL injectionCVE-2008-0845 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the person parameter.
Product
wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for
What to do
Update wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for to the newest version.
Full record and what to do →NVD record securityreason.com securityfocus.com
Feb 11, 2008SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via tCVE-2008-0682 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
SQL injection vulnerability in wordspew-rss.php in the Wordspew
Fixed in
3.72
What to do
Update SQL injection vulnerability in wordspew-rss.php in the Wordspew to 3.72 or newer.
Full record and what to do →NVD record pierre.sudarovich.free.fr secunia.com
Feb 11, 2008shiftthis-preview.php in the ShiftThis Newsletter: SQL injectionCVE-2008-0683 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.
Product
shiftthis-preview.php in the ShiftThis Newsletter
What to do
Update shiftthis-preview.php in the ShiftThis Newsletter to the newest version.
Full record and what to do →NVD record securityfocus.com exploit-db.com
Feb 11, 2008Multiple cross-site scripting (XSS) vulnerabilities in admin_panel.php in the Simon Elvery WP-Footnotes 2.2 plugin for WordPress allow remote attackers to injecCVE-2008-0691 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in admin_panel.php in the Simon Elvery WP-Footnotes 2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wp_footnotes_current_settings[priority], (2) wp_footnotes_current_settings[style_rules], (3) wp_footnotes_current_settings[pre_footnotes], and (4) wp_footnotes_current_settings[post_footnotes] parameters.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 7, 2008The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via uCVE-2008-0664 · WordPress plugins & themes · reported by MITREMedium 6.4
The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via unknown vectors.
Fixed in
2.3.3
What to do
Update the plugin to 2.3.3 or newer.
Full record and what to do →NVD record secunia.com secunia.com
Feb 6, 2008wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for: Directory traversalCVE-2008-0615 · WordPress plugins & themes · reported by MITREMedium 4
Directory traversal vulnerability in wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) folder and (2) file parameters.
Product
wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for
What to do
Update wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 4, 2008cforms-css.php in Oliver Seidel cforms: PHP remote file inclusionCVE-2008-0560 · WordPress plugins & themes · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in cforms-css.php in Oliver Seidel cforms (contactforms), a Wordpress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the tm parameter. NOTE: CVE disputes this issue for 7.3, since there is no tm parameter, and the code exits with a fatal error due to a call to an undefined function
Product
cforms-css.php in Oliver Seidel cforms
What to do
Update cforms-css.php in Oliver Seidel cforms to the newest version.
Full record and what to do →NVD record securityreason.com attrition.org
Jan 31, 2008adclick.php in the AdServe 0.2 plugin for: SQL injectionCVE-2008-0507 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
adclick.php in the AdServe 0.2 plugin for
What to do
Update adclick.php in the AdServe 0.2 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Jan 31, 2008Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commandsCVE-2008-0520 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.
Product
Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com securityfocus.com
Jan 31, 2008deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for: Cross-site request forgery (CSRF)CVE-2008-0508 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the oldstructure (aka dean_pm_config[oldstructure]) configuration setting as administrators via the old_struct parameter in a deans_permalinks_migration.php action to wp-admin/options-general.php, as demonstrated by placing an XSS sequence in this setting.
Product
deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for
What to do
Update deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for to the newest version.
Full record and what to do →NVD record g30rg3x.com g30rg3x.com
Jan 30, 2008functions/editevent.php in the WP-Cal 0.3 plugin for: SQL injectionCVE-2008-0490 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
functions/editevent.php in the WP-Cal 0.3 plugin for
What to do
Update functions/editevent.php in the WP-Cal 0.3 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Jan 30, 2008fim_rss.php in the fGallery 2.4.1 plugin for: SQL injectionCVE-2008-0491 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the album parameter.
Product
fim_rss.php in the fGallery 2.4.1 plugin for
Affected
2.4.1 to 2.4.1
What to do
Affects 2.4.1 to 2.4.1. Update fim_rss.php in the fGallery 2.4.1 plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vupen.com
Jan 10, 2008ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for: Unrestricted file uploadCVE-2008-0222 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.
Product
ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for
What to do
Update ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for to the newest version.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Jan 9, 2008wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x,: Cross-site scripting (XSS)CVE-2008-0193 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.
Product
wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x,
Affected
up to 2.3.x
What to do
Affects up to 2.3.x. Update wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk secunia.com
Jan 9, 2008Multiple cross-site scripting (XSS) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPressCVE-2008-0204 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.
Affected
up to 2.1
What to do
Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Jan 9, 2008Multiple cross-site scripting (XSS) vulnerabilities in cryptographp/admin.php in the Cryptographp 1.2 and earlier plugin for WordPress allow remote attackers toCVE-2008-0203 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in cryptographp/admin.php in the Cryptographp 1.2 and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cryptwidth, (2) cryptheight, (3) bgimg, (4) charR, (5) charG, (6) charB, (7) charclear, (8) tfont, (9) charel, (10) charelc, (11) charelv, (12) charnbmin, (13) charnbmax, (14) charspace, (15) charsizemin, (16) charsizemax, (17) charanglemax, (18) noisepxmin, (19) noisepxmax, (20) noiselinemin, (21) noiselinemax, (22) nbcirclemin, (23) nbcirclemax, or (24) brushsize parameter to wp-admin/options-general.php.
Affected
up to 1.2
What to do
Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Jan 9, 2008Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WorCVE-2008-0198 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Jan 9, 2008Multiple cross-site scripting (XSS) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress CVE-2008-0197 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wpcf_email, (2) wpcf_subject, (3) wpcf_question, (4) wpcf_answer, (5) wpcf_success_msg, (6) wpcf_error_msg, or (7) wpcf_msg parameter to wp-admin/admin.php, or (8) the SRC attribute of an IFRAME element.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Jan 9, 2008WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-adCVE-2008-0195 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages.
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Jan 9, 2008wp-db-backup.php in WordPress 2.0.3 and earlier: Directory traversalCVE-2008-0194 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete arbitrary files, and cause a denial of service via a .. (dot dot) in the backup parameter in a wp-db-backup.php action to wp-admin/edit.php. NOTE: this might be the same as CVE-2006-5705.1.
Product
wp-db-backup.php in WordPress 2.0.3 and earlier
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update wp-db-backup.php in WordPress 2.0.3 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk secunia.com
Jan 9, 2008Multiple cross-site scripting (XSS) vulnerabilities in captcha\captcha.php in the Captcha! 2.5d and earlier plugin for WordPress allow remote attackers to injecCVE-2008-0206 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in captcha\captcha.php in the Captcha! 2.5d and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) captcha_ttffolder, (2) captcha_numchars, (3) captcha_ttfrange, or (4) captcha_secret parameter.
Affected
up to 2.5d
What to do
Affects up to 2.5d. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Jan 9, 2008Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WoCVE-2008-0205 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.
Affected
up to 2.1
What to do
Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Dec 14, 2007Multiple directory traversal vulnerabilities in resize.php in the PictPress 0.91 and earlier plugin for WordPress allow remote attackers to read arbitrary filesCVE-2007-6369 · WordPress plugins & themes · reported by MITREMedium 5
Multiple directory traversal vulnerabilities in resize.php in the PictPress 0.91 and earlier plugin for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) size or (2) path parameter.
Affected
up to 0.91
What to do
Affects up to 0.91. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Dec 11, 2007wp-includes/query.php in WordPress 2.3.1 and earlier: SQL injectionCVE-2007-6318 · WordPress plugins & themes · reported by MITREMedium 6.8
SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the s parameter, when DB_CHARSET is set to (1) Big5, (2) GBK, or possibly other character set encodings that support a "\" in a multibyte character.
Product
wp-includes/query.php in WordPress 2.3.1 and earlier
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update wp-includes/query.php in WordPress 2.3.1 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk secunia.com
Nov 2, 2007Multiple PHP remote file inclusion vulnerabilities in the BackUpWordPress 0.4.2b and earlier plugin for WordPress allow remote attackers to execute arbitrary PHCVE-2007-5800 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple PHP remote file inclusion vulnerabilities in the BackUpWordPress 0.4.2b and earlier plugin for WordPress allow remote attackers to execute arbitrary PHP code via a URL in the bkpwp_plugin_path parameter to (1) plugins/BackUp/Archive.php; and (2) Predicate.php, (3) Writer.php, (4) Reader.php, and other unspecified scripts under plugins/BackUp/Archive/.
Affected
up to 0.4.2b
What to do
Affects up to 0.4.2b. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org osvdb.org
Oct 30, 2007wp-admin/edit-post-rows.php in WordPress 2.3: Cross-site scripting (XSS)CVE-2007-5710 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the posts_columns array parameter.
Product
wp-admin/edit-post-rows.php in WordPress 2.3
What to do
Update wp-admin/edit-post-rows.php in WordPress 2.3 to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Sep 26, 2007wp-register.php in WordPress 2.0 and 2.0.1: Cross-site scripting (XSS)CVE-2007-5105 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the user_email parameter.
Product
wp-register.php in WordPress 2.0 and 2.0.1
What to do
Update wp-register.php in WordPress 2.0 and 2.0.1 to the newest version.
Full record and what to do →NVD record blogsecurity.net securityreason.com
Sep 26, 2007wp-register.php in WordPress 2.0: Cross-site scripting (XSS)CVE-2007-5106 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML via the user_login parameter.
Product
wp-register.php in WordPress 2.0
What to do
Update wp-register.php in WordPress 2.0 to the newest version.
Full record and what to do →NVD record blogsecurity.net securityreason.com
Sep 14, 2007wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, whichCVE-2007-4893 · WordPress plugins & themes · reported by MITREMedium 4.3
wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record fedoranews.org secunia.com
Aug 27, 2007wp-newblog.php in WordPress multi-user: Cross-site scripting (XSS)CVE-2007-4544 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-newblog.php in WordPress multi-user (MU) 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the weblog_id parameter (Username field).
Product
wp-newblog.php in WordPress multi-user
Affected
up to 1.0
What to do
Affects up to 1.0. Update wp-newblog.php in WordPress multi-user to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org securityvulns.ru
Aug 22, 2007index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3: Cross-site scripting (XSS)CVE-2007-4483 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
Product
index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3
Fixed in
2.1.3
What to do
Update index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3 to 2.1.3 or newer.
Full record and what to do →NVD record osvdb.org securityvulns.ru
Aug 22, 2007index.php in the Pool 1.0.7 theme for: Cross-site scripting (XSS)CVE-2007-4482 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the Pool 1.0.7 theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
Product
index.php in the Pool 1.0.7 theme for
What to do
Update index.php in the Pool 1.0.7 theme for to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Aug 22, 2007index.php in the: Cross-site scripting (XSS)CVE-2007-4481 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the (1) Blix 0.9.1 and (2) Blix 0.9.1 Rus themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
Product
index.php in the
What to do
Update index.php in the to the newest version.
Full record and what to do →NVD record securityvulns.ru websecurity.com.ua
Aug 22, 2007index.php in the Sirius 1.0 theme for: Cross-site scripting (XSS)CVE-2007-4480 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the Sirius 1.0 theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
Product
index.php in the Sirius 1.0 theme for
What to do
Update index.php in the Sirius 1.0 theme for to the newest version.
Full record and what to do →NVD record osvdb.org securityvulns.ru
Aug 7, 2007Cross-site scripting (XSS) vulnerability in index.php in the Unnamed theme 1.217, and Special Edition (SE) 1.02, before 20070804 for WordPress allows remote attCVE-2007-4166 · WordPress plugins & themes · reported by MITREMedium 5
Cross-site scripting (XSS) vulnerability in index.php in the Unnamed theme 1.217, and Special Edition (SE) 1.02, before 20070804 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757, CVE-2007-4014, and CVE-2007-4165. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in index.php in the Unnamed theme 1.217, and Special Edition (SE) 1.02,
Fixed in
20070804
What to do
Update Cross-site scripting (XSS) vulnerability in index.php in the Unnamed theme 1.217, and Special Edition (SE) 1.02, to 20070804 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Aug 7, 2007Cross-site scripting (XSS) vulnerability in index.php in the Blue Memories theme 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2007-4165 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the Blue Memories theme 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757 and CVE-2007-4014. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Blue Memories
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update Blue Memories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com osvdb.org
Aug 3, 2007options.php in WordPress 2.2.1: SQL injectionCVE-2007-4154 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.
Product
options.php in WordPress 2.2.1
What to do
Update options.php in WordPress 2.2.1 to the newest version.
Full record and what to do →NVD record mybeni.rootzilla.de secunia.com
Jul 25, 2007a certain index.php installation script related to the: Cross-site scripting (XSS)CVE-2007-4014 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in a certain index.php installation script related to the (1) Blix 0.9.1, (2) Blixed 1.0, and (3) BlixKrieg (Blix Krieg) 2.2 themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
a certain index.php installation script related to the
What to do
Update a certain index.php installation script related to the to the newest version.
Full record and what to do →NVD record secunia.com secunia.com
Jul 20, 2007index.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2007-3939 · WordPress plugins & themes · reported by MITREMedium 6.8
SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter.
Product
index.php in SpoonLabs Vivvo Article Management CMS
Affected
up to 3.4
What to do
Affects up to 3.4. Update index.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org securityfocus.com
Jul 3, 2007(1) wp-app.php and: Unrestricted file uploadCVE-2007-3544 · WordPress plugins & themes · reported by MITREMedium 6.5
Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code via unspecified vectors, possibly related to the wp_postmeta table and the use of custom fields in normal (non-attachment) posts. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-3543.
Product
(1) wp-app.php and
What to do
Update (1) wp-app.php and to the newest version.
Full record and what to do →NVD record osvdb.org buayacorp.com
Jun 14, 2007404.php in the Vistered-Little theme for: Cross-site scripting (XSS)CVE-2007-3240 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI (REQUEST_URI) that accesses index.php. NOTE: this can be leveraged for PHP code execution in an administrative session.
Product
404.php in the Vistered-Little theme for
What to do
Update 404.php in the Vistered-Little theme for to the newest version.
Full record and what to do →NVD record osvdb.org securityreason.com
Jun 14, 2007functions.php in the default theme in WordPress 2.2: Cross-site scripting (XSS)CVE-2007-3238 · WordPress plugins & themes · reported by MITREMedium 6
Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATH_INFO (REQUEST_URI) to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.
Product
functions.php in the default theme in WordPress 2.2
What to do
Update functions.php in the default theme in WordPress 2.2 to the newest version.
Full record and what to do →NVD record blogsecurity.net codex.wordpress.org
Jun 14, 2007Cross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web sCVE-2007-3239 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to index.php. NOTE: this can be leveraged for PHP code execution in an administrative session.
Product
AndyBlue
Fixed in
20070607
What to do
Update AndyBlue to 20070607 or newer.
Full record and what to do →NVD record osvdb.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.