Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

534new WordPress flaws this week

391,528entries in the database

3,631 results · page 69 of 73

Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.CVE-2019-15832 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
Product
visitors-traffic-real-time-statistics
Fixed in
1.13
What to do
Update visitors-traffic-real-time-statistics to 1.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.CVE-2019-15831 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
Product
visitors-traffic-real-time-statistics
Fixed in
1.12
What to do
Update visitors-traffic-real-time-statistics to 1.12 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.CVE-2019-15828 · WordPress plugins & themes · reported by MITREHigh 8.8
The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
Product
one-click-ssl
Fixed in
1.4.7
What to do
Update one-click-ssl to 1.4.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The photo-gallery plugin before 1.2.42 for WordPress has CSRF.CVE-2015-9380 · WordPress plugins & themes · reported by MITREHigh 8.8
The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
Product
photo-gallery
Fixed in
1.2.42
What to do
Update photo-gallery to 1.2.42 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 29, 2019The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.CVE-2019-15781 · WordPress plugins & themes · reported by MITREHigh 8.8
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
Product
facebook-by-weblizar
Fixed in
2.8.5
What to do
Update facebook-by-weblizar to 2.8.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.CVE-2019-15769 · WordPress plugins & themes · reported by MITREHigh 8.8
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
Product
handl-utm-grabber
Fixed in
2.6.5
What to do
Update handl-utm-grabber to 2.6.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The wp-members plugin before 3.2.8 for WordPress has CSRF.CVE-2019-15660 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-members plugin before 3.2.8 for WordPress has CSRF.
Product
wp-members
Fixed in
3.2.8
What to do
Update wp-members to 3.2.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.CVE-2019-15645 · WordPress plugins & themes · reported by MITREHigh 8.8
The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
Product
zoho-salesiq
Fixed in
1.0.9
What to do
Update zoho-salesiq to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.CVE-2018-21006 · WordPress plugins & themes · reported by MITREHigh 8.8
The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.
Product
bbp-move-topics
Fixed in
1.1.6
What to do
Update bbp-move-topics to 1.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.CVE-2018-21002 · WordPress plugins & themes · reported by MITREHigh 8.8
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.
Product
js-support-ticket
Fixed in
2.0.6
What to do
Update js-support-ticket to 2.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-rollback plugin before 1.2.3 for WordPress has CSRF.CVE-2015-9343 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
Product
wp-rollback
Fixed in
1.2.3
What to do
Update wp-rollback to 1.2.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.CVE-2019-15329 · WordPress plugins & themes · reported by MITREHigh 8.8
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.CVE-2014-10382 · WordPress plugins & themes · reported by MITREMedium 4.3
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.
Product
feature-comments
Fixed in
1.2.5
What to do
Update feature-comments to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.CVE-2016-10918 · WordPress plugins & themes · reported by MITREHigh 8.8
The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
Product
gallery-by-supsystic
Fixed in
1.8.6
What to do
Update gallery-by-supsystic to 1.8.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.CVE-2017-18521 · WordPress plugins & themes · reported by MITREHigh 8.8
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
Product
democracy-poll
Fixed in
5.4
What to do
Update democracy-poll to 5.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 21, 2019The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.CVE-2016-10903 · WordPress plugins & themes · reported by MITREHigh 8.8
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
Product
GoDaddy godaddy-email-marketing-sign-up-forms
Fixed in
1.1.3
What to do
Update GoDaddy godaddy-email-marketing-sign-up-forms to 1.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.CVE-2016-10902 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
Product
wp-customer-reviews
Fixed in
3.0.9
What to do
Update wp-customer-reviews to 3.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.CVE-2017-18523 · WordPress plugins & themes · reported by MITREHigh 8.8
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
Product
eelv-newsletter
Fixed in
4.6.1
What to do
Update eelv-newsletter to 4.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-15238 · WordPress plugins & themes · reported by MITREHigh 8.8
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
Product
cforms2
Fixed in
15.0.2
What to do
Update cforms2 to 15.0.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.CVE-2017-18569 · WordPress plugins & themes · reported by MITREHigh 8.8
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
Product
my-wp-translate
Fixed in
1.0.4
What to do
Update my-wp-translate to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.CVE-2016-10915 · WordPress plugins & themes · reported by MITREHigh 8.8
The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
Product
popup-by-supsystic
Fixed in
1.7.9
What to do
Update popup-by-supsystic to 1.7.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.CVE-2016-10914 · WordPress plugins & themes · reported by MITREHigh 8.8
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
Product
add-from-server
Fixed in
3.3.2
What to do
Update add-from-server to 3.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.CVE-2015-9332 · WordPress plugins & themes · reported by MITREMedium 6.5
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Product
uninstall
Fixed in
1.2
What to do
Update uninstall to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.CVE-2014-10381 · WordPress plugins & themes · reported by MITREHigh 8.8
The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.
Product
user-domain-whitelist
Fixed in
1.5
What to do
Update user-domain-whitelist to 1.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-access-manager plugin before 1.2 for WordPress has CSRF.CVE-2011-5328 · WordPress plugins & themes · reported by MITREHigh 8.8
The user-access-manager plugin before 1.2 for WordPress has CSRF.
Product
user-access-manager
Fixed in
1.2
What to do
Update user-access-manager to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.CVE-2019-15115 · WordPress plugins & themes · reported by MITREHigh 8.8
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
Product
peters-login-redirect
Fixed in
2.9.2
What to do
Update peters-login-redirect to 2.9.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.CVE-2019-15114 · WordPress plugins & themes · reported by MITREHigh 8.8
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
Product
formcraft-form-builder
Fixed in
1.2.2
What to do
Update formcraft-form-builder to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.CVE-2019-15113 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
Product
companion-sitemap-generator
Fixed in
3.7.0
What to do
Update companion-sitemap-generator to 3.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The js-jobs plugin before 1.0.7 for WordPress has CSRF.CVE-2018-20974 · WordPress plugins & themes · reported by MITREHigh 8.8
The js-jobs plugin before 1.0.7 for WordPress has CSRF.
Product
js-jobs
Fixed in
1.0.7
What to do
Update js-jobs to 1.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.CVE-2018-20972 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.CVE-2018-20971 · WordPress plugins & themes · reported by MITREHigh 8.8
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
Product
church-admin
Fixed in
1.2550
What to do
Update church-admin to 1.2550 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.CVE-2017-18547 · WordPress plugins & themes · reported by MITREHigh 8.8
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
Product
nelio-ab-testing
Fixed in
4.6.4
What to do
Update nelio-ab-testing to 4.6.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.CVE-2017-18546 · WordPress plugins & themes · reported by MITREHigh 8.8
The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
Product
jayj-quicktag
Fixed in
1.3.2
What to do
Update jayj-quicktag to 1.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.CVE-2017-18544 · WordPress plugins & themes · reported by MITREHigh 8.8
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.CVE-2015-9322 · WordPress plugins & themes · reported by MITREHigh 8.8
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Product
erident-custom-login-and-dashboard
Fixed in
3.5
What to do
Update erident-custom-login-and-dashboard to 3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.CVE-2018-20968 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.
Product
wp-ultimate-exporter
Fixed in
1.4.2
What to do
Update wp-ultimate-exporter to 1.4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.CVE-2018-20967 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
Product
wp-ultimate-csv-importer
Fixed in
5.6.1
What to do
Update wp-ultimate-csv-importer to 5.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.CVE-2017-18513 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
Product
responsive-menu
Fixed in
3.1.4
What to do
Update responsive-menu to 3.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.CVE-2017-18512 · WordPress plugins & themes · reported by MITREHigh 8.8
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
Product
newsletter-by-supsystic
Fixed in
1.1.8
What to do
Update newsletter-by-supsystic to 1.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.CVE-2017-18511 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
Product
custom-sidebars
Fixed in
3.0.8.1
What to do
Update custom-sidebars to 3.0.8.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-editor plugin before 1.2.6 for WordPress has CSRF.CVE-2016-10885 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
Product
wp-editor
Fixed in
1.2.6
What to do
Update wp-editor to 1.2.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.CVE-2016-10884 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Product
simple-membership
Fixed in
3.3.3
What to do
Update simple-membership to 3.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.CVE-2016-10883 · WordPress plugins & themes · reported by MITREMedium 6.5
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
Product
simple-add-pages-or-posts
Fixed in
1.7
What to do
Update simple-add-pages-or-posts to 1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.CVE-2016-10882 · WordPress plugins & themes · reported by MITREHigh 8.8
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
Product
google-document-embedder
Fixed in
2.6.2
What to do
Update google-document-embedder to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.CVE-2015-9309 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.CVE-2015-9308 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.CVE-2015-9307 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.CVE-2013-7476 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
Product
simple-fields
Fixed in
1.2
What to do
Update simple-fields to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.CVE-2018-20964 · WordPress plugins & themes · reported by MITREHigh 8.8
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
Product
contact-form-to-email
Fixed in
1.2.66
What to do
Update contact-form-to-email to 1.2.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.