Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,844 results · page 57 of 57

May 5, 2021Elementor Addons – PowerPack Addons for Elementor: For WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24263 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addons – PowerPack Addons for Elementor
Fixed in
2.3.2
What to do
Update Elementor Addons – PowerPack Addons for Elementor to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021WooLentor – WooCommerce Elementor Addons + Builder: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24262 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
WooLentor – WooCommerce Elementor Addons + Builder
Fixed in
1.8.6
What to do
Update WooLentor – WooCommerce Elementor Addons + Builder to 1.8.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021HT Mega – Absolute Addons for Elementor Page Builder: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24261 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
HT Mega – Absolute Addons for Elementor Page Builder
Fixed in
1.5.7
What to do
Update HT Mega – Absolute Addons for Elementor Page Builder to 1.5.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Livemesh Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24260 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Livemesh Addons for Elementor
Fixed in
6.8
What to do
Update Livemesh Addons for Elementor to 6.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor Addon Elements: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24259 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addon Elements
Fixed in
1.11.2
What to do
Update Elementor Addon Elements to 1.11.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lCVE-2021-24258 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Fixed in
2.2.0
What to do
Update the plugin to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Premium Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24257 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Premium Addons for Elementor
Fixed in
4.2.8
What to do
Update Premium Addons for Elementor to 4.2.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor – Header, Footer & Blocks Template: Has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24256 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor – Header, Footer & Blocks Template
Fixed in
1.5.8
What to do
Update Elementor – Header, Footer & Blocks Template to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Essential Addons for Elementor Lite: Has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24255 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.
Product
Essential Addons for Elementor Lite
Fixed in
4.5.4
What to do
Update Essential Addons for Elementor Lite to 4.5.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter.CVE-2021-24206 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter.CVE-2021-24205 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter.CVE-2021-24204 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter.CVE-2021-24203 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter.CVE-2021-24202 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter.CVE-2021-24201 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Plus Addons for Elementor Page Builder: Was being actively exploited to by malicious actors to bypass authenticationCVE-2021-24175 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
Product
Plus Addons for Elementor Page Builder
Fixed in
4.1.7
What to do
Update Plus Addons for Elementor Page Builder to 4.1.7 or newer.
Full record and what to do →NVD record posimyth.ticksy.com wpscan.com
Apr 5, 2021Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality.CVE-2021-24158 · WordPress plugins & themes · reported by WPScanMedium 6.5
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for lower-level users, however, they can still supply the user_role parameter to update the default role for registration.
Fixed in
2.10.3
What to do
Update the plugin to 2.10.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jan 12, 2021The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.CVE-2021-3133 · WordPress plugins & themes · reported by MITREMedium 6.5
The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.
Product
Elementor Contact Form DB
Fixed in
1.6
What to do
Update Elementor Contact Form DB to 1.6 or newer.
Full record and what to do →NVD record advisory.checkmarx.net plugins.trac.wordpress.org
Jan 6, 2021The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.CVE-2020-36171 · WordPress plugins & themes · reported by MITREMedium 6.1
The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.
Product
Elementor Website Builder
Fixed in
3.0.14
What to do
Update Elementor Website Builder to 3.0.14 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Oct 7, 2020The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the EdiCVE-2020-26596 · WordPress plugins & themes · reported by MITREHigh 8.8
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.
Product
Dynamic OOO widget for the Elementor Pro
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Dynamic OOO widget for the Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record elementor.com ww2.compunet.cl
Sep 16, 2020A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions.CVE-2020-20406 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 31, 2020An issue was discovered in the Elementor plugin through 2.9.13 for WordPress.CVE-2020-15020 · WordPress plugins & themes · reported by MITREMedium 5.4
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.
Product
An issue was discovered in the Elementor
Affected
up to 2.9.13
What to do
Affects up to 2.9.13. Update An issue was discovered in the Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hidden-one.co.in wordpress.org
Aug 21, 2020Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature.CVE-2020-20634 · WordPress plugins & themes · reported by MITREMedium 6.5
Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog.
Affected
up to 2.9.5
What to do
Affects up to 2.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 17, 2020Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 alloCVE-2020-5768 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 4.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields.
Affected
4.4.8 to 4.4.8
What to do
Affects 4.4.8 to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Jul 13, 2020Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a reCVE-2020-5766 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record tenable.com tenable.com
Jun 5, 2020The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities.CVE-2020-13865 · WordPress plugins & themes · reported by MITREMedium 5.4
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
Product
Elementor Page Builder
Fixed in
2.9.9
What to do
Update Elementor Page Builder to 2.9.9 or newer.
Full record and what to do →NVD record softwaresecured.com softwaresecured.com
Jun 5, 2020The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability.CVE-2020-13864 · WordPress plugins & themes · reported by MITREMedium 5.4
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
Product
Elementor Page Builder
Fixed in
2.9.9
What to do
Update Elementor Page Builder to 2.9.9 or newer.
Full record and what to do →NVD record softwaresecured.com softwaresecured.com
May 16, 2020An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125.CVE-2020-13126 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.
Product
An issue was discovered in the Elementor Pro
Fixed in
2.9.4
What to do
Update An issue was discovered in the Elementor Pro to 2.9.4 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
May 16, 2020An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-CVE-2020-13125 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.
Product
An issue was discovered in the "Ultimate Addons for Elementor
Fixed in
1.24.2
What to do
Update An issue was discovered in the "Ultimate Addons for Elementor to 1.24.2 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Jan 28, 2020The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page.CVE-2020-8426 · WordPress plugins & themes · reported by MITREMedium 5.4
The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.
Product
Elementor
Fixed in
2.8.5
What to do
Update Elementor to 2.8.5 or newer.
Full record and what to do →NVD record blog.impenetrable.tech wordpress.org
Jan 22, 2020The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.CVE-2020-7109 · WordPress plugins & themes · reported by MITRECritical 9.8
The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.
Product
Elementor Page Builder
Fixed in
2.8.4
What to do
Update Elementor Page Builder to 2.8.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 2, 2020The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.CVE-2019-20204 · WordPress plugins & themes · reported by MITREMedium 5.4
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
Affected
up to 1.9.40
What to do
Affects up to 1.9.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Nov 11, 2019A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributCVE-2019-18855 · WordPress plugins & themes · reported by MITREHigh 7.5
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes.
Product
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG)
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com plugins.trac.wordpress.org
Oct 17, 2019WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.CVE-2019-17672 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org seclists.org
Oct 7, 2019The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.CVE-2018-18379 · WordPress plugins & themes · reported by MITREMedium 6.1
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.
Product
elementor-edit-template class in wp-admin/customize.php in the Elementor Pro
Fixed in
2.0.10
What to do
Update elementor-edit-template class in wp-admin/customize.php in the Elementor Pro to 2.0.10 or newer.
Full record and what to do →NVD record elementor.com contextis.com
Sep 10, 2019The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.CVE-2017-18596 · WordPress plugins & themes · reported by MITREHigh 8.8
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
Product
elementor
Fixed in
1.8.0
What to do
Update elementor to 1.8.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.CVE-2019-15839 · WordPress plugins & themes · reported by MITREHigh 7.5
The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.
Product
sina-extension-for-elementor
Fixed in
2.2.1
What to do
Update sina-extension-for-elementor to 2.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.CVE-2015-9313 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Product
newstatpress
Fixed in
1.0.5
What to do
Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.CVE-2015-9312 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Product
newstatpress
Fixed in
1.0.5
What to do
Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 18, 2018WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).CVE-2018-5776 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
Fixed in
4.9.2
What to do
Update the plugin to 4.9.2 or newer.
Full record and what to do →NVD record codex.wordpress.org github.com
Dec 2, 2017wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to condCVE-2017-17093 · WordPress plugins & themes · reported by MITREMedium 5.4
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.
Fixed in
4.9.1
What to do
Update the plugin to 4.9.1 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Oct 12, 2017WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) aCVE-2016-9263 · WordPress plugins & themes · reported by MITREMedium 4.7
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com opnsec.com
May 21, 2016flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2,: Cross-site scripting (XSS)CVE-2016-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Product
flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2,
Fixed in
2.21.0
What to do
Update flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, to 2.21.0 or newer.
Full record and what to do →NVD record openwall.com securitytracker.com
Aug 18, 2014The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in anCVE-2014-5266 · WordPress plugins & themes · reported by MITREMedium 5
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
Fixed in
3.9.2
What to do
Update the plugin to 3.9.2 or newer.
Full record and what to do →NVD record cgit.drupalcode.org cgit.drupalcode.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.