Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

472new WordPress flaws this week

390,714entries in the database

275 results · page 6 of 6

Sep 10, 2021Wordpress Simple Shop: Reflected Cross-Site ScriptingCVE-2021-38340 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
Wordpress Simple Shop
Affected
up to 1.2
What to do
Affects up to 1.2. Update Wordpress Simple Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 19, 2021Shopping Cart & eCommerce Store: Cross-Site Request ForgeryCVE-2021-34645 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0.
Product
Shopping Cart & eCommerce Store
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 9, 2021Astra Pro Addon: Did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated userCVE-2021-24507 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues
Product
Astra Pro Addon
Fixed in
3.5.2
What to do
Update Astra Pro Addon to 3.5.2 or newer.
Full record and what to do →NVD record wpastra.com wpscan.com
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ pageCVE-2021-24319 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue
Product
Bello - Directory & Listing
Fixed in
1.6.0
What to do
Update Bello - Directory & Listing to 1.6.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Nov 7, 2020The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize.CVE-2020-28339 · WordPress plugins & themes · reported by MITREHigh 7.5
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain.
Product
usc-e-shop (aka Collne Welcart e-Commerce)
Fixed in
1.9.36
What to do
Update usc-e-shop (aka Collne Welcart e-Commerce) to 1.9.36 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 23, 2019The Easy Digital Downloads (EDD) Shoppette theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.1CVE-2015-9535 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Shoppette theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org
Sep 25, 2019The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.CVE-2015-9413 · WordPress plugins & themes · reported by MITREMedium 6.5
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Product
eshop
Affected
up to 6.3.13
What to do
Affects up to 6.3.13. Update eshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 13, 2019The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.CVE-2016-10951 · WordPress plugins & themes · reported by MITREHigh 7.2
The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
Affected
2.07.02 to 2.07.02
What to do
Affects 2.07.02 to 2.07.02. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 12, 2019WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier: Cross-site request forgery (CSRF)CVE-2019-5992 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier
Affected
up to 4.4
What to do
Affects up to 4.4. Update WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp jvn.jp
May 13, 2019Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web scripCVE-2019-7411 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL).
Product
MyThemeShop Launcher
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update MyThemeShop Launcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record metamorfosec.com wpvulndb.com
Dec 29, 2017The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtainCVE-2015-3302 · WordPress plugins & themes · reported by MITREHigh 7.5
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Product
TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin)
Fixed in
1.3.9.3
What to do
Update TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) to 1.3.9.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 21, 2017The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which aCVE-2015-3421 · WordPress plugins & themes · reported by MITREMedium 6.1
The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.
Affected
up to 6.3.11
What to do
Affects up to 6.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com htbridge.com
May 23, 2017Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2015-5468 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to includes/download.php.
Product
Directory traversal vulnerability in the WP e-Commerce Shop Styling
Fixed in
2.6
What to do
Update Directory traversal vulnerability in the WP e-Commerce Shop Styling to 2.6 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Jan 23, 2017Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL comCVE-2016-0769 · WordPress plugins & themes · reported by Red HatHigh 8.8
Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
Product
eShop
Affected
6.3.14 to 6.3.14
What to do
Affects 6.3.14 to 6.3.14. Update eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 23, 2017Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web CVE-2016-0765 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter.
Product
eShop
Affected
6.3.14 to 6.3.14
What to do
Affects 6.3.14 to 6.3.14. Update eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
May 14, 2015the TheCartPress eCommerce Shopping Cart: Cross-site request forgery (CSRF)CVE-2015-3986 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Product
the TheCartPress eCommerce Shopping Cart
Fixed in
1.3.9.3
What to do
Update the TheCartPress eCommerce Shopping Cart to 1.3.9.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 14, 2015the TheCartPress eCommerce Shopping Cart: Directory traversalCVE-2015-3301 · WordPress plugins & themes · reported by MITREMedium 4
Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Product
the TheCartPress eCommerce Shopping Cart
Fixed in
1.3.9.3
What to do
Update the TheCartPress eCommerce Shopping Cart to 1.3.9.3 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
May 14, 2015Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WorCVE-2015-3300 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2) billing_lastname, (3) billing_company, (4) billing_tax_id_number, (5) billing_city, (6) billing_street, (7) billing_street_2, (8) billing_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shipping_lastname, (14) shipping_company, (15) shipping_tax_id_number, (16) shipping_city, (17) shipping_street, (18) shipping_street_2, (19) shipping_postcode, (20) shipping_telephone_1, (21) shipping_telephone_2, or (22) shipping_fax parameter to shopping-cart/checkout/; the (23) search_by parameter in the admin/AddressesList.php page to wp-admin/admin.php; the (24) address_id, (25) address_name, (26) firstname, (27) lastname, (28) street, (29) city, (30) postcode, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type parameter in the admin/AssignedCategoriesList.php page to wp-admin/admin.php; or the (3
Fixed in
1.3.9.3
What to do
Update the plugin to 1.3.9.3 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Oct 21, 2014Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackersCVE-2014-4577 · WordPress plugins & themes · reported by MITREMedium 5
Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.
Product
WP AmASIN - The Amazon Affiliate Shop
Affected
up to 0.9.6
What to do
Affects up to 0.9.6. Update WP AmASIN - The Amazon Affiliate Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com plugins.svn.wordpress.org
Jul 2, 2014Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) plugin 3.1.0 and earlier for WorCVE-2014-4557 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) plugin 3.1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
Product
Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop)
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows remote attackers to inCVE-2014-4556 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
Product
Swipe Checkout for eShop
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Swipe Checkout for eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
May 27, 2014includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8: PHP remote file inclusionCVE-2013-0724 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comHigh 7.5
PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows remote attackers to execute arbitrary PHP code via a URL in the dompdf parameter.
Product
includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8
Fixed in
1.8
What to do
Update includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 to 1.8 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
May 13, 2014Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack tCVE-2013-2705 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings.
Product
Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart
Fixed in
3.6
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart to 3.6 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Jan 23, 2013Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or CVE-2012-6506 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.
Product
Zingiri Web Shop
What to do
Update Zingiri Web Shop to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jul 18, 2012Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.CVE-2012-4033 · WordPress plugins & themes · reported by MITREHigh 10
Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.
Product
Multiple unspecified vulnerabilities in the Zingiri Web Shop
Fixed in
2.4.0
What to do
Update Multiple unspecified vulnerabilities in the Zingiri Web Shop to 2.4.0 or newer.
Full record and what to do →NVD record forums.zingiri.com secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.