Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
327 results · page 6 of 7
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to editCVE-2022-24664 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jan 17, 2022ACF Photo Gallery Field: Does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_editCVE-2021-24909 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- ACF Photo Gallery Field
- Fixed in
- 1.7.5
- What to do
- Update ACF Photo Gallery Field to 1.7.5 or newer.
Dec 21, 2021WP Visitor Statistics (Real Time Traffic): Does not properly sanitise and escape the refUrl in the refDetails AJAX actionCVE-2021-24750 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 4.8
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 4.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Dec 13, 2021User Meta Shortcodes: Registers a shortcode that allows any user with a roleCVE-2021-24859 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
- Product
- User Meta Shortcodes
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update User Meta Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Display Post Metadata: Adds a shortcode to print out custom fieldsCVE-2021-24855 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Display Post Metadata
- Fixed in
- 1.5.0
- What to do
- Update Display Post Metadata to 1.5.0 or newer.
Dec 7, 2021The debug-meta-data plugin 1.1.2 for WordPress allows XSS.CVE-2020-27356 · WordPress plugins & themes · reported by MITREMedium 5.4
The debug-meta-data plugin 1.1.2 for WordPress allows XSS.
- Affected
- 1.1.2 to 1.1.2
- What to do
- Affects 1.1.2 to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2021Simple Download Monitor: Does not escape the "File Thumbnail" post meta before outputting it in some pagesCVE-2021-24693 · WordPress plugins & themes · reported by WPScanCritical 9
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
- Product
- Simple Download Monitor
- Fixed in
- 3.9.5
- What to do
- Update Simple Download Monitor to 3.9.5 or newer.
Sep 20, 2021Timetable and Event Schedule: Outputs the Hashed PasswordCVE-2021-24585 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.0
- What to do
- Update Timetable and Event Schedule to 2.4.0 or newer.
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24584 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.2
- What to do
- Update Timetable and Event Schedule to 2.4.2 or newer.
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24583 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.2
- What to do
- Update Timetable and Event Schedule to 2.4.2 or newer.
Sep 20, 2021options.php file of the WP-Board: Beta accepts a postid parameterCVE-2021-24404 · WordPress plugins & themes · reported by WPScanHigh 8.8
The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query ran twice.
- Product
- options.php file of the WP-Board
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update options.php file of the WP-Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 13, 2021Timetable and Event Schedule by MotoPress: Does not sanitise some of its parametersCVE-2021-24724 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
- Product
- Timetable and Event Schedule by MotoPress
- Fixed in
- 2.3.19
- What to do
- Update Timetable and Event Schedule by MotoPress to 2.3.19 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 6, 2021Keyword Meta: Does not sanitise of escape its settings before outputting them back in the page after they are savedCVE-2021-24611 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.
- Product
- Keyword Meta
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Keyword Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2021Site Reviews: Does not sanitise some of its Review DetailsCVE-2021-24603 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed
- Product
- Site Reviews
- Fixed in
- 5.13.1
- What to do
- Update Site Reviews to 5.13.1 or newer.
Jul 13, 2021WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8: Cross-site request forgery (CSRF)CVE-2021-20781 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8
- What to do
- Update WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 to the newest version.
Jul 6, 2021Export Users With Meta: Did not escape the list of roles to export before using them in a SQL statement in the export functionalityCVE-2021-24451 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection.
- Product
- Export Users With Meta
- Fixed in
- 0.6.5
- What to do
- Update Export Users With Meta to 0.6.5 or newer.
May 17, 2021There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta datCVE-2021-24289 · WordPress plugins & themes · reported by WPScanHigh 8.8
There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
- Product
- Store Locator Plus for
- Affected
- up to 5.5.14
- What to do
- Affects up to 5.5.14. Update Store Locator Plus for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comwordfence.com
Mar 18, 2021Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadatCVE-2021-24126 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata (namely title) before outputting them in the generated gallery, which could lead to privilege escalation.
- Product
- Envira Gallery Lite
- Fixed in
- 1.8.3.3
- What to do
- Update Envira Gallery Lite to 1.8.3.3 or newer.
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.CVE-2020-36155 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user meta that defines a user's role. During the registration process, submitted registration details were passed to the update_profile function, and any metadata was accepted, e.g., wp_capabilities[administrator] for Administrator access.
- Product
- An issue was discovered in the Ultimate Member
- Fixed in
- 2.1.12
- What to do
- Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD recordwordpress.orgwpscan.com
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/aCVE-2020-35934 · WordPress plugins & themes · reported by MITREMedium 4.3
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).
- Product
- Advanced Access Manager
- Fixed in
- 6.6.2
- What to do
- Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Nov 2, 2020is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is CVE-2020-28039 · WordPress plugins & themes · reported by MITRECritical 9.1
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 23, 2020Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing DetailCVE-2019-18834 · WordPress plugins & themes · reported by MITREMedium 6.1
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.
- Product
- Persistent XSS in the WooCommerce Subscriptions
- Fixed in
- 2.6.3
- What to do
- Update Persistent XSS in the WooCommerce Subscriptions to 2.6.3 or newer.
Full record and what to do →NVD recordwoocommerce.comprecursorsecurity.com
Jun 12, 2020In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved.CVE-2020-4050 · WordPress plugins & themes · reported by GitHubLow 3.5
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- What to do
- Update the plugin to the newest version.
Apr 19, 2020In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gCVE-2020-11928 · WordPress plugins & themes · reported by MITRECritical 9.8
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.
- Product
- In the media-library-assistant
- Fixed in
- 2.82
- What to do
- Update In the media-library-assistant to 2.82 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escCVE-2020-11514 · WordPress plugins & themes · reported by MITRECritical 9.8
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
- Product
- Rank Math
- Affected
- up to 1.0.40.2
- What to do
- Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordrankmath.comwordpress.org
Oct 17, 2019WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series CVE-2019-17669 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD recordblog.wpscan.orgcore.trac.wordpress.org
Sep 20, 2019The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.CVE-2015-9400 · WordPress plugins & themes · reported by MITREHigh 8.8
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
- Product
- wordpress-meta-robots
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update wordpress-meta-robots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.CVE-2016-11010 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
- Product
- wp-invoice
- Fixed in
- 4.1.1
- What to do
- Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.CVE-2016-11009 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
- Product
- wp-invoice
- Fixed in
- 4.1.1
- What to do
- Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.CVE-2016-11008 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
- Product
- wp-invoice
- Fixed in
- 4.1.1
- What to do
- Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 16, 2019The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.CVE-2016-10960 · WordPress plugins & themes · reported by MITREHigh 8.8
The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.
- Product
- wsecure
- Fixed in
- 2.4
- What to do
- Update wsecure to 2.4 or newer.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Sep 9, 2019The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.CVE-2018-21011 · WordPress plugins & themes · reported by MITREHigh 7.5
The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.
- Product
- charitable
- Fixed in
- 1.5.14
- What to do
- Update charitable to 1.5.14 or newer.
Full record and what to do →NVD recordwordpress.orgwpcharitable.com
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.CVE-2019-15329 · WordPress plugins & themes · reported by MITREHigh 8.8
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
- Product
- import-users-from-csv-with-meta
- Fixed in
- 1.14.0.3
- What to do
- Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.CVE-2019-15328 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
- Product
- import-users-from-csv-with-meta
- Fixed in
- 1.14.0.3
- What to do
- Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-15327 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
- Product
- import-users-from-csv-with-meta
- Fixed in
- 1.14.1.3
- What to do
- Update import-users-from-csv-with-meta to 1.14.1.3 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-15326 · WordPress plugins & themes · reported by MITREHigh 7.5
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
- Product
- import-users-from-csv-with-meta
- Fixed in
- 1.14.2.1
- What to do
- Update import-users-from-csv-with-meta to 1.14.2.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 22, 2019The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.CVE-2017-18580 · WordPress plugins & themes · reported by MITRECritical 9.8
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
- Product
- shortcodes-ultimate
- Fixed in
- 5.0.1
- What to do
- Update shortcodes-ultimate to 5.0.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.CVE-2016-10920 · WordPress plugins & themes · reported by MITREMedium 6.1
The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
- Product
- gnucommerce
- Fixed in
- 0.5.7-BETA
- What to do
- Update gnucommerce to 0.5.7-BETA or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.CVE-2017-18504 · WordPress plugins & themes · reported by MITREHigh 8.8
The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.
- Product
- twitter-cards-meta
- Fixed in
- 2.5.0
- What to do
- Update twitter-cards-meta to 2.5.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.CVE-2017-18503 · WordPress plugins & themes · reported by MITREMedium 6.1
The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.
- Product
- twitter-cards-meta
- Fixed in
- 2.5.0
- What to do
- Update twitter-cards-meta to 2.5.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.CVE-2019-14948 · WordPress plugins & themes · reported by MITREMedium 5.4
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
- Product
- woocommerce-product-addon
- Fixed in
- 18.4
- What to do
- Update woocommerce-product-addon to 18.4 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 9, 2019The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.CVE-2019-14794 · WordPress plugins & themes · reported by MITREHigh 7.5
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.
- Product
- Meta Box
- Fixed in
- 4.16.2
- What to do
- Update Meta Box to 4.16.2 or newer.
Aug 9, 2019The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.CVE-2019-14793 · WordPress plugins & themes · reported by MITREMedium 6.5
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
- Product
- Meta Box
- Fixed in
- 4.16.3
- What to do
- Update Meta Box to 4.16.3 or newer.
Full record and what to do →NVD recordmetabox.iopluginvulnerabilities.com
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
- Product
- codection "Import users from CSV with meta
- Fixed in
- 1.14.2.2
- What to do
- Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 15, 2019The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.CVE-2013-7472 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
- Product
- Count per Day
- Fixed in
- 3.2.6
- What to do
- Update Count per Day to 3.2.6 or newer.
Full record and what to do →NVD recordlists.openwall.networdpress.org
Feb 19, 2019WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, sucCVE-2019-8942 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
- Fixed in
- 4.9.9
- What to do
- Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comrapid7.com
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call.CVE-2018-20148 · WordPress plugins & themes · reported by MITRECritical 9.8
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
- Fixed in
- 4.9.9
- What to do
- Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD recordsecurityfocus.comblog.secarma.co.uk
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.CVE-2018-20147 · WordPress plugins & themes · reported by MITREMedium 6.5
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
- Fixed in
- 4.9.9
- What to do
- Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD recordsecurityfocus.comcodex.wordpress.org
Dec 12, 2018The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.CVE-2018-20101 · WordPress plugins & themes · reported by MITREMedium 6.1
The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.
- Product
- codection "Import users from CSV with meta
- Fixed in
- 1.12.1
- What to do
- Update codection "Import users from CSV with meta to 1.12.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Feb 11, 2018Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.CVE-2018-6891 · WordPress plugins & themes · reported by MITREMedium 6.1
Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.
- Fixed in
- 14.5
- What to do
- Update the plugin to 14.5 or newer.
Full record and what to do →NVD recordwordpress.orggubello.me
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.