Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

570new WordPress flaws this week

391,397entries in the database

4,892 results · page 58 of 98

Apr 1, 2020The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.CVE-2020-6753 · WordPress plugins & themes · reported by MITREMedium 6.1
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.
Product
Login by Auth0
Fixed in
4.0.0
What to do
Update Login by Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com github.com
Apr 1, 2020A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.CVE-2020-5392 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.
Product
A stored cross-site scripting (XSS) vulnerability exists in the Auth0
Fixed in
4.0.0
What to do
Update A stored cross-site scripting (XSS) vulnerability exists in the Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com github.com
Apr 1, 2020Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.CVE-2020-5391 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.
Product
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0
Fixed in
4.0.0
What to do
Update Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com github.com
Mar 31, 2020LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code executionCVE-2020-6008 · WordPress plugins & themes · reported by cve@checkpoint.comCritical 9.8
LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution
Fixed in
3.37.15
What to do
Update the plugin to 3.37.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 27, 2020The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection.CVE-2020-10817 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
Product
custom-searchable-data-entry-system (aka Custom Searchable Data Entry System)
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avveng.com plugins.trac.wordpress.org
Mar 24, 2020A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.CVE-2020-10385 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
Product
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite)
Fixed in
1.5.9
What to do
Update A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) to 1.5.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Mar 23, 2020An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.CVE-2020-9392 · WordPress plugins & themes · reported by MITREHigh 7.3
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, createFromTpl, and getJSONExportTable endpoints, unauthenticated users can retrieve pricing table information, create new tables, or import/modify a table.
Product
An issue was discovered in the pricing-table-by-supsystic
Fixed in
1.8.2
What to do
Update An issue was discovered in the pricing-table-by-supsystic to 1.8.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 20, 2020An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitraryCVE-2019-13463 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the "echo get_the_title()" or "echo $term->name" statement.
Product
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory
Fixed in
7.3.5
What to do
Update An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory to 7.3.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 20, 2020The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.CVE-2019-12498 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.
Product
WP Live Chat Support
Fixed in
8.0.33
What to do
Update WP Live Chat Support to 8.0.33 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 17, 2020The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.CVE-2018-18576 · WordPress plugins & themes · reported by MITREMedium 5.3
The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.
Product
Hustle (aka wordpress-popup)
Affected
up to 6.0.5
What to do
Affects up to 6.0.5. Update Hustle (aka wordpress-popup) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pastebin.com wordpress.org
Mar 16, 2020be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role viCVE-2020-7916 · WordPress plugins & themes · reported by MITREMedium 6.5
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
Product
LearnPress
Affected
up to 3.2.6.5
What to do
Affects up to 3.2.6.5. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 14, 2020The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison.CVE-2020-10568 · WordPress plugins & themes · reported by MITREHigh 8.8
The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.
Product
sitepress-multilingual-cms (WPML)
Fixed in
4.3.7-b.2
What to do
Update sitepress-multilingual-cms (WPML) to 4.3.7-b.2 or newer.
Full record and what to do →NVD record medium.com wpvulndb.com
Mar 13, 2020An issue was discovered in the File Upload plugin before 4.13.0 for WordPress.CVE-2020-10564 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call.
Product
An issue was discovered in the File Upload
Fixed in
4.13.0
What to do
Update An issue was discovered in the File Upload to 4.13.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Mar 13, 2020An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an CVE-2020-10196 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several of the popup's fields by sending a request to wp-admin/admin-ajax.php with the POST action parameter of sgpb_autosave and including additional data in an allPopupData parameter, including the popup's ID (which is visible in the source of the page in which the popup is inserted) and arbitrary JavaScript which will then be executed in the browsers of visitors to that page. Because the plugin functionality automatically adds script tags to data entered into these fields, this injection will typically bypass most WAF applications.
Product
An XSS vulnerability in the popup-builder
Fixed in
3.64.1
What to do
Update An XSS vulnerability in the popup-builder to 3.64.1 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Mar 13, 2020The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via adminCVE-2020-10195 · WordPress plugins & themes · reported by MITREMedium 6.3
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.
Product
popup-builder
Fixed in
3.64.1
What to do
Update popup-builder to 3.64.1 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Mar 12, 2020XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.CVE-2020-8436 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.
Product
RegistrationMagic
Affected
4.6.0.0 to 4.6.0.0
What to do
Affects 4.6.0.0 to 4.6.0.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record spider-security.co.uk spider-security.co.uk
Mar 12, 2020An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress.CVE-2020-8435 · WordPress plugins & themes · reported by MITREHigh 8.1
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter.
Product
RegistrationMagic
Affected
4.6.0.0 to 4.6.0.0
What to do
Affects 4.6.0.0 to 4.6.0.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record spider-security.co.uk spider-security.co.uk
Mar 10, 2020controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via tCVE-2018-14502 · WordPress plugins & themes · reported by MITRECritical 9.8
controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.
Product
controllers/quizzes.php in the Kiboko Chained Quiz
Fixed in
1.0.9
What to do
Update controllers/quizzes.php in the Kiboko Chained Quiz to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 9, 2020The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functionCVE-2020-10257 · WordPress plugins & themes · reported by MITRECritical 9.8
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Product
ThemeREX Addons
Fixed in
2020-03-09
What to do
Update ThemeREX Addons to 2020-03-09 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submittCVE-2020-9458 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and chaCVE-2020-9457 · WordPress plugins & themes · reported by MITREHigh 8.8
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their CVE-2020-9456 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of theCVE-2020-9455 · WordPress plugins & themes · reported by MITREMedium 4.3
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator tCVE-2020-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
Product
A CSRF vulnerability in the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update A CSRF vulnerability in the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 4, 2020The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formCVE-2020-9372 · WordPress plugins & themes · reported by MITREHigh 7.8
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
Product
Appointment Booking Calendar
Fixed in
1.3.35
What to do
Update Appointment Booking Calendar to 1.3.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com drive.google.com
Mar 4, 2020Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress.CVE-2020-9371 · WordPress plugins & themes · reported by MITREMedium 4.8
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
Product
Stored XSS exists in the Appointment Booking Calendar
Fixed in
1.3.35
What to do
Update Stored XSS exists in the Appointment Booking Calendar to 1.3.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com drive.google.com
Feb 28, 2020Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticaCVE-2020-9459 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.
Product
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Feb 28, 2020The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.CVE-2020-9466 · WordPress plugins & themes · reported by MITREMedium 6.1
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.
Product
Export Users to CSV
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Export Users to CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com getastra.com
Feb 26, 2020The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufCVE-2019-19134 · WordPress plugins & themes · reported by MITREMedium 6.1
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record heroplugins.com heroplugins.com
Feb 25, 2020An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.CVE-2020-9394 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.
Product
An issue was discovered in the pricing-table-by-supsystic
Fixed in
1.8.2
What to do
Update An issue was discovered in the pricing-table-by-supsystic to 1.8.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 25, 2020An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.CVE-2020-9393 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.
Product
An issue was discovered in the pricing-table-by-supsystic
Fixed in
1.8.2
What to do
Update An issue was discovered in the pricing-table-by-supsystic to 1.8.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 25, 2020The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.CVE-2020-9019 · WordPress plugins & themes · reported by MITREMedium 6.1
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
Affected
5.5.3 to 5.5.3
What to do
Affects 5.5.3 to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.ikiu.ac.ir uploadboy.com
Feb 25, 2020Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress.CVE-2020-9335 · WordPress plugins & themes · reported by MITREMedium 4.8
Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users.
Fixed in
1.5.46
What to do
Update the plugin to 1.5.46 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 25, 2020A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress.CVE-2020-9334 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.
Product
A stored XSS vulnerability exists in the Envira Photo Gallery
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update A stored XSS vulnerability exists in the Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 24, 2020An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce.CVE-2020-8819 · WordPress plugins & themes · reported by MITREHigh 8.1
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Feb 24, 2020includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multipleCVE-2019-17229 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.
Product
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads)
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Feb 24, 2020includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unautCVE-2019-17228 · WordPress plugins & themes · reported by MITREMedium 6.5
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
Product
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads)
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Feb 20, 2020A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress.CVE-2020-9003 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.
Product
A stored XSS vulnerability exists in the Modula Image Gallery
Fixed in
2.2.5
What to do
Update A stored XSS vulnerability exists in the Modula Image Gallery to 2.2.5 or newer.
Full record and what to do →NVD record fortiguard.com github.com
Feb 18, 2020WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass VulnerabilitiesCVE-2013-4454 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities
Affected
1.4.1 to 1.4.1
What to do
Affects 1.4.1 to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Feb 17, 2020The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.CVE-2020-9043 · WordPress plugins & themes · reported by MITREHigh 8.8
The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.
Product
wpCentral
Fixed in
1.5.1
What to do
Update wpCentral to 1.5.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 17, 2020Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php.CVE-2020-6850 · WordPress plugins & themes · reported by MITREMedium 6.1
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.
Product
Utilities.php in the miniorange-saml-20-single-sign-on
Fixed in
4.8.84
What to do
Update Utilities.php in the miniorange-saml-20-single-sign-on to 4.8.84 or newer.
Full record and what to do →NVD record wordpress.org zeroauth.ltd
Feb 17, 2020Popup Builder plugin 2.2.8 through 2.6.7.6: SQL injection (in the sgImportPopups function in sg_popup_ajaxCVE-2020-9006 · WordPress plugins & themes · reported by MITRECritical 9.8
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)
Product
Popup Builder plugin 2.2.8 through 2.6.7.6
Affected
up to 2.6.7.6
What to do
Affects up to 2.6.7.6. Update Popup Builder plugin 2.2.8 through 2.6.7.6 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 14, 2020The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninjCVE-2020-8594 · WordPress plugins & themes · reported by MITREMedium 5.4
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].
Affected
3.4.22 to 3.4.22
What to do
Affects 3.4.22 to 3.4.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record spider-security.co.uk wordpress.org
Feb 13, 2020Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow CVE-2013-1401 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll.
Product
editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll
Affected
34.05 to 34.05
What to do
Affects 34.05 to 34.05. Update editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Feb 13, 2020Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the polliCVE-2013-1400 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Feb 12, 2020WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution VulnerabilityCVE-2013-2010 · WordPress plugins & themes · reported by Red HatCritical 9.8
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Feb 11, 2020A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.CVE-2013-5988 · WordPress plugins & themes · reported by MITREMedium 6.1
A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.
Product
A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack
Fixed in
2.0.3.1
What to do
Update A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack to 2.0.3.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Feb 11, 2020NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file uploadCVE-2013-3684 · WordPress plugins & themes · reported by MITRECritical 9.8
NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload
Product
NextGEN Gallery
Fixed in
1.9.13
What to do
Update NextGEN Gallery to 1.9.13 or newer.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Feb 11, 2020participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the aCVE-2020-8596 · WordPress plugins & themes · reported by MITREHigh 7.5
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
Product
Participants Database
Affected
up to 1.9.5.5
What to do
Affects up to 1.9.5.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.impenetrable.tech wpvulndb.com
Feb 10, 2020WordPress plugin wp-cleanfix has Remote Code ExecutionCVE-2013-2109 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress plugin wp-cleanfix has Remote Code Execution
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com exchange.xforce.ibmcloud.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.