Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
296 results · page 6 of 6
Apr 17, 2024coreActivity: Activity Logging plugin for: Retrieved IP addresses of requests via headers such X-FORWARDED to log themCVE-2024-0868 · WordPress plugins & themes · reported by WPScanMedium 5.3
The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value
- Product
- coreActivity: Activity Logging plugin for
- Fixed in
- 2.1
- What to do
- Update coreActivity: Activity Logging plugin for to 2.1 or newer.
Apr 12, 2024Uncode Core: Missing AuthorizationCVE-2023-51515 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Undsgn Uncode Core allows Privilege Escalation.This issue affects Uncode Core: from n/a through 2.8.8.
- Product
- Uncode Core
- Affected
- up to 2.8.8
- What to do
- Affects up to 2.8.8. Update Uncode Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score: Sensitive Information ExposureCVE-2023-7046 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated attackers to extract sensitive data including TLS Certificate Private Keys
- Product
- WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 8, 2024WPB Show Core: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-1958 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Apr 8, 2024wpb-show-core: Does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated requestCVE-2024-1956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated request, leading to a Reflected Cross-Site Scripting
- Product
- wpb-show-core
- Fixed in
- 2.7
- What to do
- Update wpb-show-core to 2.7 or newer.
Apr 8, 2024WPB Show Core: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2024-1292 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Apr 5, 2024WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function.CVE-2023-5692 · WordPress plugins & themes · reported by WordfenceMedium 5.3
WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordcore.trac.wordpress.orgdeveloper.wordpress.org
Mar 28, 2024Hercules Core: Deserialization of Untrusted DataCVE-2024-30228 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Hercules Design Hercules Core.This issue affects Hercules Core : from n/a through 6.4.
- Product
- Hercules Core
- Affected
- up to 6.4
- What to do
- Affects up to 6.4. Update Hercules Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 26, 2024JupiterX Core: Unrestricted Upload of File with Dangerous TypeCVE-2023-38388 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5.
- Product
- JupiterX Core
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 26, 2024Cosmetsy theme (core plugin): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49839 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo theme (core plugin), KlbTheme Bacola theme (core plugin), KlbTheme Medibazar theme (core plugin), KlbTheme Furnob theme (core plugin), KlbTheme Clotya theme (core plugin) allows Reflected XSS.This issue affects Cosmetsy theme (core plugin): from n/a through 1.3.0; Partdo theme (core plugin): from n/a through 1.0.9; Bacola theme (core plugin): from n/a through 1.3.3; Medibazar theme (core plugin): from n/a through 1.2.3; Furnob theme (core plugin): from n/a through 1.1.7; Clotya theme (core plugin): from n/a through 1.1.5.
- Product
- Cosmetsy theme (core plugin)
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Cosmetsy theme (core plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 16, 2024Core Control: Does not have CSRF check in placeCVE-2022-1760 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Core Control
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Core Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2024NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: Cross-Site Request Forgery (CSRF)CVE-2023-52121 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: from n/a through 1.10.2.
- Product
- NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Core Web Vitals & PageSpeed Booster: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-35883 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12.
- Product
- Core Web Vitals & PageSpeed Booster
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update Core Web Vitals & PageSpeed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Salient Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme nectar Salient Core allows Stored XSS.This issue affects Salient Core: from n/a through 2.0.2.
- Product
- Salient Core
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Salient Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Salient Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48748 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme nectar Salient Core allows Reflected XSS.This issue affects Salient Core: from n/a through 2.0.2.
- Product
- Salient Core
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Salient Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 27, 2023WPB Show Core: Is vulnerable to server-side request forgery (SSRF) via the `path` parameterCVE-2023-5974 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter.
- Product
- WPB Show Core
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WPB Show Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2023WPB Show Core: Is vulnerable to a local file inclusion via the `path` parameterCVE-2023-4922 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPB Show Core WordPress plugin through 2.2 is vulnerable to a local file inclusion via the `path` parameter.
- Product
- WPB Show Core
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WPB Show Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 20, 2023Jupiter X Core: Arbitrary file downloadsCVE-2023-3813 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. NOTE: This vulnerability was partially patched in version 4.6.5 and fully patched in version 4.6.9.
- Product
- Jupiter X Core
- Affected
- up to 4.6.6
- What to do
- Affects up to 4.6.6. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 17, 2023WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter.CVE-2023-2745 · WordPress plugins & themes · reported by WordfenceMedium 5.4
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcore.trac.wordpress.orgwordpress.org
Nov 14, 2022The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.CVE-2022-3484 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- What to do
- Update the plugin to the newest version.
Jul 11, 2022core plugin for kitestudio: Does not sanitise and escape some parameters before outputting them back in a response of an AJAX actionCVE-2022-1951 · WordPress plugins & themes · reported by WPScanMedium 6.1
The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting.
- Product
- core plugin for kitestudio
- Fixed in
- 2.3.1
- What to do
- Update core plugin for kitestudio to 2.3.1 or newer.
Jun 13, 2022Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the inCVE-2022-1659 · WordPress plugins & themes · reported by WordfenceMedium 5.4
Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrCVE-2022-1654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions
- Affected
- up to 6.10.1
- What to do
- Affects up to 6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Mar 14, 2022Insight Core: Does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user)CVE-2021-24950 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user), does not validate user input before passing it to unserialize(), nor sanitise and escape it before outputting it in the response. As a result, it could allow users with a role as low as Subscriber to perform PHP Object Injection, as well as Stored Cross-Site Scripting attacks
- Product
- Insight Core
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Insight Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022Core Tweaks WP Setup: Allows to bulk-set many settings in WordPressCVE-2021-24803 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks
- Product
- Core Tweaks WP Setup
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Core Tweaks WP Setup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 17, 2021WP Performance Score Booster: Does not have CSRF checkCVE-2021-24776 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- WP Performance Score Booster
- Fixed in
- 2.1
- What to do
- Update WP Performance Score Booster to 2.1 or newer.
Jul 13, 2021A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in thCVE-2020-26153 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
- Fixed in
- 4.10.7.p
- What to do
- Update the plugin to 4.10.7.p or newer.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
May 6, 2021The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX aCVE-2021-24246 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues
- Product
- Workscout Core
- Fixed in
- 1.3.4
- What to do
- Update Workscout Core to 1.3.4 or newer.
Aug 31, 2020Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.CVE-2020-20625 · WordPress plugins & themes · reported by MITREHigh 7.5
Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
- Affected
- up to 3.8.2
- What to do
- Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jan 13, 2020Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remotCVE-2020-6859 · WordPress plugins & themes · reported by MITREMedium 5.3
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.
- Product
- Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2019The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x CVE-2015-9505 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Sep 17, 2019The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.CVE-2016-10993 · WordPress plugins & themes · reported by MITREMedium 5.4
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
- Product
- ScoreMe
- Affected
- up to 2016-04-01
- What to do
- Affects up to 2016-04-01. Update ScoreMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comvulnerability-lab.com
Sep 16, 2019The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.CVE-2016-10968 · WordPress plugins & themes · reported by MITREHigh 8.8
The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.
- Product
- peepso-core
- Fixed in
- 1.6.1
- What to do
- Update peepso-core to 1.6.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 13, 2019The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= CVE-2019-12516 · WordPress plugins & themes · reported by MITREHigh 8.8
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI.
- Product
- slickquiz
- Affected
- up to 1.3.7.1
- What to do
- Affects up to 1.3.7.1. Update slickquiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Aug 27, 2019The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme upCVE-2019-15650 · WordPress plugins & themes · reported by MITREMedium 4.3
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
- Product
- stops-core-theme-and-plugin-updates
- Fixed in
- 8.0.5
- What to do
- Update stops-core-theme-and-plugin-updates to 8.0.5 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 8, 2019core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.CVE-2019-14679 · WordPress plugins & themes · reported by MITREMedium 6.5
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
- Product
- ARPrice Lite
- Affected
- 2.2 to 2.2
- What to do
- Affects 2.2 to 2.2. Update ARPrice Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Oct 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0CVE-2018-17866 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field.
- Fixed in
- 2.0.28
- What to do
- Update the plugin to 2.0.28 or newer.
Full record and what to do →NVD recordserhack.mewordpress.org
Jun 26, 2018WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker cCVE-2018-1000556 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacker must craft an URL with payload and send to the user. Victim need to open the link to be affected by reflected XSS. .
- Fixed in
- 12.0.6
- What to do
- Update the plugin to 12.0.6 or newer.
Full record and what to do →NVD recordpluginvulnerabilities.compluginvulnerabilities.com
Feb 16, 2018core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitizeCVE-2018-6944 · WordPress plugins & themes · reported by MITREMedium 6.1
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
- Product
- UltimateMember
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update UltimateMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Feb 16, 2018core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitizCVE-2018-6943 · WordPress plugins & themes · reported by MITREMedium 6.1
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
- Product
- UltimateMember
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update UltimateMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Aug 18, 2017Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.CVE-2017-12948 · WordPress plugins & themes · reported by MITREMedium 6.1
Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.
- Product
- PressForward
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update PressForward to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddefensecode.comdefensecode.com
Jan 14, 2017Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script CVE-2017-5488 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
- Fixed in
- 4.7.1
- What to do
- Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD recorddebian.orgopenwall.com
Dec 17, 2015lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of prevCVE-2015-7527 · WordPress plugins & themes · reported by Red HatHigh 7.5
lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of preview image" and possibly other input fields in the "Video Gallery Settings" page.
- Product
- Cool Video Gallery
- Affected
- 1.9 to 1.9
- What to do
- Affects 1.9 to 1.9. Update Cool Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in frame-maker.php in the Walk Score plugin 0.5.5 and earlier for WordPress allow remote attackers to injectCVE-2014-4573 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in frame-maker.php in the Walk Score plugin 0.5.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s or (2) o parameter.
- Product
- Walk Score
- Affected
- up to 0.5.5
- What to do
- Affects up to 0.5.5. Update Walk Score to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Dec 31, 2013zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4: SQL injectionCVE-2013-7242 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter.
- Product
- zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4
- Fixed in
- 1.4.5.4
- What to do
- Update zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 to 1.4.5.4 or newer.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers CVE-2012-1068 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
- Product
- Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments
- Fixed in
- 2.0.7
- What to do
- Update Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments to 2.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.