Updated 15 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,813 results · page 54 of 57

Mar 10, 2020controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via tCVE-2018-14502 · WordPress plugins & themes · reported by MITRECritical 9.8
controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.
Product
controllers/quizzes.php in the Kiboko Chained Quiz
Fixed in
1.0.9
What to do
Update controllers/quizzes.php in the Kiboko Chained Quiz to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 13, 2020Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the polliCVE-2013-1400 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Jan 13, 2020WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite VulnerabilityCVE-2014-6059 · WordPress plugins & themes · reported by MITREHigh 7.2
WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability
Fixed in
2.8.2
What to do
Update the plugin to 2.8.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and emaiCVE-2019-19984 · WordPress plugins & themes · reported by MITREMedium 6.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Dec 19, 2019The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirCVE-2019-19915 · WordPress plugins & themes · reported by MITRECritical 9
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.
Product
301 Redirects - Easy Redirect Manager
Fixed in
2.45
What to do
Update 301 Redirects - Easy Redirect Manager to 2.45 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Oct 23, 2019The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x bCVE-2015-9517 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x beforeCVE-2015-9512 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org
Oct 16, 2019The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided CVE-2019-16523 · WordPress plugins & themes · reported by MITREMedium 5.4
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.
Product
events-manager
Affected
up to 5.9.5
What to do
Affects up to 5.9.5. Update events-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2019The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.CVE-2015-9468 · WordPress plugins & themes · reported by MITREMedium 6.1
The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.
Affected
0.4.5 to 0.4.5
What to do
Affects 0.4.5 to 0.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 10, 2019The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.CVE-2015-9467 · WordPress plugins & themes · reported by MITRECritical 9.8
The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.
Product
broken-link-manager
Fixed in
0.5.0
What to do
Update broken-link-manager to 0.5.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.CVE-2015-9453 · WordPress plugins & themes · reported by MITREMedium 6.1
The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
Product
broken-link-manager
Fixed in
0.6.0
What to do
Update broken-link-manager to 0.6.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.CVE-2015-9426 · WordPress plugins & themes · reported by MITREMedium 4.6
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
Product
manual-image-crop
Fixed in
1.11
What to do
Update manual-image-crop to 1.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallockeCVE-2015-9425 · WordPress plugins & themes · reported by MITREMedium 5.4
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.
Product
social-locker
Fixed in
4.2.5
What to do
Update social-locker to 4.2.5 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.CVE-2015-9390 · WordPress plugins & themes · reported by MITREMedium 4.3
The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
Product
admin-management-xtended
Fixed in
2.4.0.1
What to do
Update admin-management-xtended to 2.4.0.1 or newer.
Full record and what to do →NVD record security.szurek.pl wordpress.org
Sep 20, 2019The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.CVE-2015-9386 · WordPress plugins & themes · reported by MITREMedium 6.1
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
Product
mtouch-quiz
Fixed in
3.1.3
What to do
Update mtouch-quiz to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org davidsopas.com
Sep 10, 2019The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.CVE-2017-18603 · WordPress plugins & themes · reported by MITREMedium 6.1
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
Product
postman-smtp
Affected
up to 2017-10-04
What to do
Affects up to 2017-10-04. Update postman-smtp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Sep 3, 2019The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] paramCVE-2019-15889 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
Product
download-manager
Fixed in
2.9.94
What to do
Update download-manager to 2.9.94 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 3, 2019The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.CVE-2019-15868 · WordPress plugins & themes · reported by MITREHigh 8.8
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
Product
affiliates-manager
Fixed in
2.6.6
What to do
Update affiliates-manager to 2.6.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 28, 2019iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9379 · WordPress plugins & themes · reported by MITREMedium 6.1
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
iThemes Builder Style Manager
Fixed in
0.7.7
What to do
Update iThemes Builder Style Manager to 0.7.7 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9371 · WordPress plugins & themes · reported by MITREMedium 6.1
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Manual Purchases Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Manual Purchases Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 22, 2019The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.CVE-2013-7480 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
Product
events-manager
Fixed in
5.3.6.1
What to do
Update events-manager to 5.3.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.CVE-2013-7479 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
Product
events-manager
Fixed in
5.3.9
What to do
Update events-manager to 5.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.CVE-2013-7478 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
Product
events-manager
Fixed in
5.5
What to do
Update events-manager to 5.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.CVE-2013-7477 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
Product
events-manager
Fixed in
5.5.2
What to do
Update events-manager to 5.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.CVE-2012-6716 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
Product
events-manager
Fixed in
5.1.7
What to do
Update events-manager to 5.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.CVE-2015-9319 · WordPress plugins & themes · reported by MITREMedium 6.1
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Product
gregs-high-performance-seo
Fixed in
1.6.2
What to do
Update gregs-high-performance-seo to 1.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-access-manager plugin before 1.2 for WordPress has CSRF.CVE-2011-5328 · WordPress plugins & themes · reported by MITREHigh 8.8
The user-access-manager plugin before 1.2 for WordPress has CSRF.
Product
user-access-manager
Fixed in
1.2
What to do
Update user-access-manager to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.CVE-2015-9300 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Product
events-manager
Fixed in
5.5.7
What to do
Update events-manager to 5.5.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.CVE-2015-9299 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
Product
events-manager
Fixed in
5.5.7.1
What to do
Update events-manager to 5.5.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has code injection.CVE-2015-9298 · WordPress plugins & themes · reported by MITRECritical 9.8
The events-manager plugin before 5.6 for WordPress has code injection.
Product
events-manager
Fixed in
5.6
What to do
Update events-manager to 5.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has XSS.CVE-2015-9297 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.6 for WordPress has XSS.
Product
events-manager
Fixed in
5.6
What to do
Update events-manager to 5.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.CVE-2012-6713 · WordPress plugins & themes · reported by MITREMedium 6.1
The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.
Product
job-manager
Fixed in
0.7.19
What to do
Update job-manager to 0.7.19 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 5, 2019Attendance Manager 0.5.6 and earlier: Cross-site request forgery (CSRF)CVE-2019-5971 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Attendance Manager 0.5.6 and earlier
Affected
up to 0.5.6
What to do
Affects up to 0.5.6. Update Attendance Manager 0.5.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record attmgr.com jvn.jp
Jul 5, 2019Attendance Manager 0.5.6 and earlier: Cross-site scriptingCVE-2019-5970 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Attendance Manager 0.5.6 and earlier
Affected
up to 0.5.6
What to do
Affects up to 0.5.6. Update Attendance Manager 0.5.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record attmgr.com jvn.jp
May 6, 2019The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_defaulCVE-2019-11807 · WordPress plugins & themes · reported by MITREHigh 7.5
The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_default_keys_load parameter because of a nopriv_ registration and a lack of capabilities checks.
Product
WooCommerce Checkout Manager
Fixed in
4.3
What to do
Update WooCommerce Checkout Manager to 4.3 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Apr 15, 2019There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.CVE-2018-16967 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
Product
mndpsingh287 File Manager
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update mndpsingh287 File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com wordpress.org
Apr 15, 2019There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.CVE-2018-16966 · WordPress plugins & themes · reported by MITREHigh 8.8
There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
Product
mndpsingh287 File Manager
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update mndpsingh287 File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com wordpress.org
Apr 12, 2019The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-maCVE-2018-13137 · WordPress plugins & themes · reported by MITREMedium 4.8
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
Affected
5.9.4 to 5.9.4
What to do
Affects 5.9.4 to 5.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com gist.github.com
Mar 21, 2019The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.CVE-2019-9908 · WordPress plugins & themes · reported by MITREMedium 6.1
The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.
Affected
2.1.1 to 2.1.1
What to do
Affects 2.1.1 to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org lists.openwall.net
Mar 5, 2019The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR MaCVE-2019-9574 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role.
Product
WP Human Resource Management
Fixed in
2.2.6
What to do
Update WP Human Resource Management to 2.2.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 5, 2019The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.CVE-2019-9573 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.
Product
WP Human Resource Management
Fixed in
2.2.6
What to do
Update WP Human Resource Management to 2.2.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the diCVE-2018-19043 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mreloCVE-2018-19042 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.CVE-2018-19041 · WordPress plugins & themes · reported by MITREMedium 6.1
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to CVE-2018-19040 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 14, 2019The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templateCVE-2019-6267 · WordPress plugins & themes · reported by MITREMedium 6.1
The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI.
Affected
28.07-17 to 28.07-17
What to do
Affects 28.07-17 to 28.07-17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 7, 2018The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transienCVE-2018-16363 · WordPress plugins & themes · reported by MITREMedium 5.4
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
Affected
2.9 to 2.9
What to do
Affects 2.9 to 2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.51cto.com plugins.trac.wordpress.org
Aug 26, 2018Plainview Activity Monitor plugin before 20180826: OS command injectionCVE-2018-15877 · WordPress plugins & themes · reported by MITREHigh 8.8
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request.
Product
Plainview Activity Monitor plugin before 20180826
Fixed in
20180826
What to do
Update Plainview Activity Monitor plugin before 20180826 to 20180826 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jun 17, 2018SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation CVE-2018-10969 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.
Product
SQL injection vulnerability in the Pie Register
Fixed in
3.0.10
What to do
Update SQL injection vulnerability in the Pie Register to 3.0.10 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 30, 2018class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change VulnerCVE-2018-11579 · WordPress plugins & themes · reported by MITREMedium 5.3
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
Product
MULTIDOTS WooCommerce Category Banner Management
Affected
1.1.0 to 1.1.0
What to do
Affects 1.1.0 to 1.1.0. Update MULTIDOTS WooCommerce Category Banner Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.