Updated 28 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

2,781 results · page 56 of 56

Jan 15, 2019In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at lCVE-2017-18356 · WordPress plugins & themes · reported by MITREHigh 8.8
In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection involving the includes/shortcodes/class-wc-shortcode-products.php WC_Shortcode_Products::get_products() use of cached queries within shortcodes.
Product
In the Automattic WooCommerce
Fixed in
3.2.4
What to do
Update In the Automattic WooCommerce to 3.2.4 or newer.
Full record and what to do →NVD record blog.ripstech.com woocommerce.wordpress.com
Jun 19, 2018The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.CVE-2018-11525 · WordPress plugins & themes · reported by MITREHigh 7.8
The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jun 1, 2018An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress.CVE-2018-11486 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CSS textarea field, which will be loaded on every site page.
Product
MULTIDOTS Advance Search for WooCommerce
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update MULTIDOTS Advance Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com labs.threatpress.com
Jun 1, 2018MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier: Stored XSSCVE-2018-11485 · WordPress plugins & themes · reported by MITREMedium 6.1
The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack is possible by modifying the "referral_site" cookie to have an XSS payload, and placing an order.
Product
MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com labs.threatpress.com
May 30, 2018class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change VulnerCVE-2018-11579 · WordPress plugins & themes · reported by MITREMedium 5.3
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
Product
MULTIDOTS WooCommerce Category Banner Management
Affected
1.1.0 to 1.1.0
What to do
Affects 1.1.0 to 1.1.0. Update MULTIDOTS WooCommerce Category Banner Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com wordpress.org
Mar 14, 2018A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode paCVE-2018-8711 · WordPress plugins & themes · reported by MITRECritical 9.8
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.
Product
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF)
Fixed in
2.2.0
What to do
Update A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD record sec-consult.com wordpress.org
Mar 14, 2018A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode pCVE-2018-8710 · WordPress plugins & themes · reported by MITRECritical 9.8
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.
Product
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF)
Fixed in
2.2.0
What to do
Update A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD record sec-consult.com wordpress.org
Feb 8, 2018Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2015-2329 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.3.6
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.3.6 or newer.
Full record and what to do →NVD record fortiguard.com raw.githubusercontent.com
Jan 9, 2018The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.CVE-2018-5316 · WordPress plugins & themes · reported by MITREMedium 6.1
The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.
Product
SagePay Server Gateway for WooCommerce
Fixed in
1.0.9
What to do
Update SagePay Server Gateway for WooCommerce to 1.0.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Dec 29, 2017The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtainCVE-2015-3302 · WordPress plugins & themes · reported by MITREHigh 7.5
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Product
TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin)
Fixed in
1.3.9.3
What to do
Update TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) to 1.3.9.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 29, 2017The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, whicCVE-2017-17058 · WordPress plugins & themes · reported by MITREHigh 7.5
The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template files have "if (!defined('ABSPATH')) {exit;}" code
Product
WooCommerce
Affected
up to 3.x
What to do
Affects up to 3.x. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com exploit-db.com
May 23, 2017Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2015-5468 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to includes/download.php.
Product
Directory traversal vulnerability in the WP e-Commerce Shop Styling
Fixed in
2.6
What to do
Update Directory traversal vulnerability in the WP e-Commerce Shop Styling to 2.6 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Jan 3, 2017Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary webCVE-2016-10112 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted tax-rate table values in CSV format.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.6.9
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.6.9 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Jun 25, 2016The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of tCVE-2016-4828 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account.
Product
Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 25, 2016Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web scriCVE-2016-4827 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826.
Product
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 25, 2016Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web scriCVE-2016-4826 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4827.
Product
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 25, 2016The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code vCVE-2016-4825 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.6
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.
Product
Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jun 24, 2015Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WoCVE-2015-5065 · WordPress plugins & themes · reported by MITREMedium 5
Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter.
Fixed in
1.4
What to do
Update the plugin to 1.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 14, 2015the TheCartPress eCommerce Shopping Cart: Cross-site request forgery (CSRF)CVE-2015-3986 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Product
the TheCartPress eCommerce Shopping Cart
Fixed in
1.3.9.3
What to do
Update the TheCartPress eCommerce Shopping Cart to 1.3.9.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 14, 2015the TheCartPress eCommerce Shopping Cart: Directory traversalCVE-2015-3301 · WordPress plugins & themes · reported by MITREMedium 4
Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Product
the TheCartPress eCommerce Shopping Cart
Fixed in
1.3.9.3
What to do
Update the TheCartPress eCommerce Shopping Cart to 1.3.9.3 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
May 14, 2015Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WorCVE-2015-3300 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2) billing_lastname, (3) billing_company, (4) billing_tax_id_number, (5) billing_city, (6) billing_street, (7) billing_street_2, (8) billing_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shipping_lastname, (14) shipping_company, (15) shipping_tax_id_number, (16) shipping_city, (17) shipping_street, (18) shipping_street_2, (19) shipping_postcode, (20) shipping_telephone_1, (21) shipping_telephone_2, or (22) shipping_fax parameter to shopping-cart/checkout/; the (23) search_by parameter in the admin/AddressesList.php page to wp-admin/admin.php; the (24) address_id, (25) address_name, (26) firstname, (27) lastname, (28) street, (29) city, (30) postcode, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type parameter in the admin/AssignedCategoriesList.php page to wp-admin/admin.php; or the (3
Fixed in
1.3.9.3
What to do
Update the plugin to 1.3.9.3 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Feb 24, 2015Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2015-2069 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.2.11
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.2.11 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 13, 2015Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1CVE-2014-10017 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) changeSort or (2) switch parameter in the usces_itemedit page to wp-admin/admin.php.
Product
Welcart e-Commerce
Affected
1.3.12 to 1.3.12
What to do
Affects 1.3.12 to 1.3.12. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jan 13, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script CVE-2014-10016 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) unspecified vectors related to purchase_limit or the (2) name, (3) intl, (4) nocod, or (5) time parameter in an add_delivery_method action to wp-admin/admin-ajax.php.
Product
Welcart e-Commerce
Affected
1.3.12 to 1.3.12
What to do
Affects 1.3.12 to 1.3.12. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Oct 14, 2014Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2014-6313 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.2.3 or newer.
Full record and what to do →NVD record seclists.org secunia.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPresCVE-2014-4549 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.
Fixed in
0.1.6.7
What to do
Update the plugin to 0.1.6.7 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org
May 27, 2014includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8: PHP remote file inclusionCVE-2013-0724 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comHigh 7.5
PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows remote attackers to execute arbitrary PHP code via a URL in the dompdf parameter.
Product
includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8
Fixed in
1.8
What to do
Update includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 to 1.8 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
May 8, 2014Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, allows remote attacCVE-2013-5916 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.
Product
Bradesco Gateway
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update Bradesco Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Oct 8, 2012SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vCVE-2012-5310 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
SQL injection vulnerability in the WP e-Commerce
Fixed in
3.8.7.6
What to do
Update SQL injection vulnerability in the WP e-Commerce to 3.8.7.6 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 23, 2012wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for: Cross-site scripting (XSS)CVE-2011-5104 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are obtained from third party information.
Product
wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for
What to do
Update wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for to the newest version.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
May 18, 2009Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitraCVE-2008-6811 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/.
Product
e-Commerce
Affected
up to 3.4
What to do
Affects up to 3.4. Update e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.