Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

2,857 results · page 56 of 58

Jan 9, 2018The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.CVE-2018-5312 · WordPress plugins & themes · reported by MITREMedium 5.4
The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.
Affected
1.8.0 to 1.8.0
What to do
Affects 1.8.0 to 1.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.phCVE-2018-5213 · WordPress plugins & themes · reported by MITREMedium 5.4
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
Product
Simple Download Monitor
Fixed in
3.5.4
What to do
Update Simple Download Monitor to 3.5.4 or newer.
Full record and what to do →NVD record github.com github.com
Dec 18, 2017An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress.CVE-2017-16949 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and file-uploader/file-uploader-class.php. This allows the attacker to upload anything they want to the server, as demonstrated by an action=ap_file_upload_action&allowedExtensions[]=php request to /wp-admin/admin-ajax.php that results in a .php file upload and resultant PHP code execution.
Product
An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Nov 29, 2017XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminCVE-2017-17059 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php.
Product
amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post)
Affected
up to 8.1.3
What to do
Affects up to 8.1.3. Update amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Nov 28, 2017The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templCVE-2017-17043 · WordPress plugins & themes · reported by MITREMedium 6.1
The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Oct 16, 2017Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2014-8087 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/ph_save.php.
Product
Cross-site scripting (XSS) vulnerability in the post highlights
Fixed in
2.6.1
What to do
Update Cross-site scripting (XSS) vulnerability in the post highlights to 2.6.1 or newer.
Full record and what to do →NVD record g0blin.co.uk wordpress.org
Sep 27, 2017Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.CVE-2017-2551 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 27, 2017Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.CVE-2017-14842 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 23, 2017Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility oCVE-2017-14723 · WordPress plugins & themes · reported by MITRECritical 9.8
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 12, 2017In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticaCVE-2015-9230 · WordPress plugins & themes · reported by MITREMedium 4.8
In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record openwall.com cxsecurity.com
Sep 12, 2017In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via CVE-2015-9229 · WordPress plugins & themes · reported by MITREMedium 4.8
In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.
Product
Photocrati NextGEN Gallery
Affected
2.1.15 to 2.1.15
What to do
Affects 2.1.15 to 2.1.15. Update Photocrati NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com github.com
Sep 12, 2017In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extensionCVE-2015-9228 · WordPress plugins & themes · reported by MITREHigh 8.8
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
Product
Photocrati NextGEN Gallery
What to do
Update Photocrati NextGEN Gallery to the newest version.
Full record and what to do →NVD record openwall.com cybersecurityworks.com
Aug 2, 2017The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-iCVE-2017-12199 · WordPress plugins & themes · reported by MITRECritical 9.8
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-item, tag_group_update_order list_item, category_products_update_order category-product-item, custom_fields_update_order field-item, categories_update_order category-item, subcategories_update_order subcategory-item, and tags_update_order tag-list-item.
Affected
4.2.11 to 4.2.11
What to do
Affects 4.2.11 to 4.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jun 1, 2017The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.CVE-2017-9337 · WordPress plugins & themes · reported by MITREMedium 6.1
The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.
Affected
2.5 to 2.5
What to do
Affects 2.5 to 2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lncken.cn lncken.cn
Jun 1, 2017The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.CVE-2017-9336 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.
Affected
1.6 to 1.6
What to do
Affects 1.6 to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lncken.cn lncken.cn
May 18, 2017In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.CVE-2017-9065 · WordPress plugins & themes · reported by MITREHigh 7.5
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 18, 2017In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.CVE-2017-9062 · WordPress plugins & themes · reported by MITREHigh 8.6
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Apr 2, 2017The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not requiCVE-2017-1001000 · WordPress plugins & themes · reported by 46fe6300-5254-4a98-9594-a9567bec8179High 7.5
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
Fixed in
4.7.2
What to do
Update the plugin to 4.7.2 or newer.
Full record and what to do →NVD record openwall.com securitytracker.com
Jan 29, 2017wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2: Cross-site scripting (XSS)CVE-2017-5612 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.
Product
wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2
Fixed in
4.7.2
What to do
Update wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 to 4.7.2 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 14, 2017wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com nCVE-2017-5491 · WordPress plugins & themes · reported by MITREMedium 5.3
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Oct 10, 2016Reflected XSS in wordpress plugin ajax-random-post v2.00CVE-2016-1000127 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin ajax-random-post v2.00
Affected
up to 2.00
What to do
Affects up to 2.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.CVE-2016-5837 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/inCVE-2016-5835 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3: Cross-site scripting (XSS)CVE-2016-5834 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
Product
the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3
Fixed in
4.5.3
What to do
Update the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 21, 2016The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypassCVE-2015-5715 · WordPress plugins & themes · reported by MITREMedium 4.3
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
Fixed in
4.3.1
What to do
Update the plugin to 4.3.1 or newer.
Full record and what to do →NVD record debian.org debian.org
May 14, 2016The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST reqCVE-2016-1209 · WordPress plugins & themes · reported by vultures@jpcert.or.jpCritical 9.8
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
Product
Ninja Forms
Fixed in
2.9.42.1
What to do
Update Ninja Forms to 2.9.42.1 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 25, 2016Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTCVE-2016-1160 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the WP Favorite Posts
Fixed in
1.6.6
What to do
Update Cross-site scripting (XSS) vulnerability in the WP Favorite Posts to 1.6.6 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Nov 9, 2015wp-admin/post.php in WordPress before 4.2.4: Cross-site request forgery (CSRF)CVE-2015-5731 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action.
Product
wp-admin/post.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update wp-admin/post.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4: SQL injectionCVE-2015-2213 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
Product
the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Aug 19, 2015SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameteCVE-2015-6522 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.
Product
SQL injection vulnerability in the WP Symposium
Fixed in
15.8
What to do
Update SQL injection vulnerability in the WP Symposium to 15.8 or newer.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Aug 3, 2015WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and crCVE-2015-5623 · WordPress plugins & themes · reported by MITREMedium 4
WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record codex.wordpress.org openwall.com
May 15, 2015SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the CVE-2015-3325 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERY_STRING to the default URI.
Product
SQL injection vulnerability in forum.php in the WP Symposium
Fixed in
15.4
What to do
Update SQL injection vulnerability in forum.php in the WP Symposium to 15.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Mar 30, 2015The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted requestCVE-2015-2791 · WordPress plugins & themes · reported by MITREMedium 6.4
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.
Product
menu sync" function in the WPML
Fixed in
3.1.9
What to do
Update menu sync" function in the WPML to 3.1.9 or newer.
Full record and what to do →NVD record klikki.fi packetstormsecurity.com
Jan 13, 2015Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by CVE-2014-10021 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/.
Product
WP Symposium
Affected
14.11 to 14.11
What to do
Affects 14.11 to 14.11. Update WP Symposium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Jan 7, 2015SQL injection vulnerability in the "the_search_function" function in cardoza_ajax_search.php in the AJAX Post Search (cardoza-ajax-search) plugin before 1.3 forCVE-2012-5853 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the "the_search_function" function in cardoza_ajax_search.php in the AJAX Post Search (cardoza-ajax-search) plugin before 1.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the srch_txt parameter in a "the_search_text" action to wp-admin/admin-ajax.php.
Fixed in
1.3
What to do
Update the plugin to 1.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Jan 5, 2015Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentiCVE-2014-2598 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the quickppr_redirects[request][] parameter in the redirect-updates page to wp-admin/admin.php.
Product
Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect
Fixed in
5.0.5
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect to 5.0.5 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Jan 1, 2015Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execute arbitrary SQL commCVE-2011-5308 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) cdnvote_post_id or (2) cdnvote_point parameter.
Product
Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote
Fixed in
0.4.2
What to do
Update Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote to 0.4.2 or newer.
Full record and what to do →NVD record wpsecure.net plugins.trac.wordpress.org
Dec 31, 2014Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the aCVE-2014-9401 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the lpa_post_letters parameter in the wp-limit-posts-automatically.php page to wp-admin/options-general.php.
Product
WP Limit Posts Automatically
Affected
up to 0.7
What to do
Affects up to 0.7. Update WP Limit Posts Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Dec 31, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attackers to hijack the authCVE-2014-9393 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) idptt_twitter_username or (2) idptt_tweet_prefix parameter to wp-admin/options-general.php.
Product
Post to Twitter
Affected
up to 0.7
What to do
Affects up to 0.7. Update Post to Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Dec 24, 2014SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrCVE-2014-8810 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action.
Product
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium
Fixed in
14.11
What to do
Update SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium to 14.11 or newer.
Full record and what to do →NVD record secunia.com security.szurek.pl
Dec 24, 2014Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script CVE-2014-8809 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter in an addComment action to ajax/profile_functions.php, (2) compose_text parameter in a sendMail action to ajax/mail_functions.php, (3) comment parameter in an add_comment action to ajax/lounge_functions.php, or (4) name parameter in a create_album action to ajax/gallery_functions.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium
Fixed in
14.11
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium to 14.11 or newer.
Full record and what to do →NVD record security.szurek.pl wpsymposium.com
Nov 26, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before 2014-07-23, for WorCVE-2014-9098 · WordPress plugins & themes · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before 2014-07-23, for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the videoadssearchQuery parameter to (1) videoads/videoads.php, (2) video/video.php, or (3) playlist/playlist.php.
Product
Apptha WordPress Video Gallery (contus-video-gallery)
Fixed in
2014-07-23
What to do
Update Apptha WordPress Video Gallery (contus-video-gallery) to 2014-07-23 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 26, 2014Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WCVE-2014-9097 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow (1) remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to wp-admin/admin-ajax.php or (2) remote authenticated users to execute arbitrary SQL commands via the playlistId parameter in the newplaylist page or (3) videoId parameter in a newvideo page to wp-admin/admin.php.
Product
Apptha WordPress Video Gallery (contus-video-gallery)
Fixed in
2014-07-23
What to do
Update Apptha WordPress Video Gallery (contus-video-gallery) to 2014-07-23 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTMCVE-2012-4226 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Title, (2) Content, or (3) New category field to wordpress/ or (4) query string to wordpress/.
Affected
1.9.1 to 1.9.1
What to do
Affects 1.9.1 to 1.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Aug 29, 2014The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtaCVE-2014-5337 · WordPress plugins & themes · reported by MITREMedium 5
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.
Product
WordPress Mobile Pack
Fixed in
2.0.2
What to do
Update WordPress Mobile Pack to 2.0.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jul 11, 2014SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the idCVE-2014-4938 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php.
Product
WP Rss Poster (wp-rss-poster)
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update WP Rss Poster (wp-rss-poster) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in wu-ratepost.php in the Wu-Rating plugin 1.0 12319 and earlier for WordPress allows remote attackers to inject arbitrCVE-2014-4601 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wu-ratepost.php in the Wu-Rating plugin 1.0 12319 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the v parameter.
Product
Wu-Rating
Affected
up to 12319
What to do
Affects up to 12319. Update Wu-Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in posts/videowhisper/r_logout.php in the Video Posts Webcam Recorder plugin 1.55.4 and earlier for WordPress allows reCVE-2014-4568 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in posts/videowhisper/r_logout.php in the Video Posts Webcam Recorder plugin 1.55.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Product
Video Posts Webcam Recorder
Affected
up to 1.55.4
What to do
Affects up to 1.55.4. Update Video Posts Webcam Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Jul 2, 2014Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers tCVE-2014-4524 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter.
Product
Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types
Fixed in
1.4.4
What to do
Update Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types to 1.4.4 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org
Jul 1, 2014the WP-FaceThumb plugin possibly 1.0 and earlier for: Cross-site scripting (XSS)CVE-2014-4585 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WP-FaceThumb plugin possibly 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajax_url parameter to index.php.
Product
the WP-FaceThumb plugin possibly 1.0 and earlier for
Affected
up to 1.0
What to do
Affects up to 1.0. Update the WP-FaceThumb plugin possibly 1.0 and earlier for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.