Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
338 results · page 7 of 7
Nov 29, 2022The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data.CVE-2021-31693 · WordPress plugins & themes · reported by MITREMedium 6.1
The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware information, previously connected to this CVE ID because of a typo, is at CVE-2022-31693.
- Product
- 10Web Photo Gallery
- Affected
- up to 1.5.68
- What to do
- Affects up to 1.5.68. Update 10Web Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 21, 2022WP User Frontend: Uses a user supplied argument called urhidden in its registration formCVE-2021-24649 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin
- Product
- WP User Frontend
- Fixed in
- 3.5.29
- What to do
- Update WP User Frontend to 3.5.29 or newer.
Oct 17, 2022Frontend File Manager: Does not have CSRF checkCVE-2022-3126 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf
- Product
- Frontend File Manager
- Fixed in
- 21.4
- What to do
- Update Frontend File Manager to 21.4 or newer.
Oct 10, 2022Top Bar: Does not sanitise and escape some of its settings before outputting them in frontend pagesCVE-2022-2629 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Top Bar
- Fixed in
- 3.0.4
- What to do
- Update Top Bar to 3.0.4 or newer.
Oct 3, 2022Frontend File Manager: Allows any authenticated usersCVE-2022-3125 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE
- Product
- Frontend File Manager
- Fixed in
- 21.3
- What to do
- Update Frontend File Manager to 21.3 or newer.
Oct 3, 2022Frontend File Manager: Allows any unauthenticated user to rename uploaded files from usersCVE-2022-3124 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server
- Product
- Frontend File Manager
- Fixed in
- 21.3
- What to do
- Update Frontend File Manager to 21.3 or newer.
Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
- Product
- Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro
- Fixed in
- 5.12.3
- What to do
- Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.
Aug 8, 2022Frontend File Manager & Sharing: Does not filter file extensionsCVE-2022-2356 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.
- Product
- Frontend File Manager & Sharing
- Fixed in
- 1.1.3
- What to do
- Update Frontend File Manager & Sharing to 1.1.3 or newer.
Jul 25, 2022Popup Anything: Does not sanitise and escape a parameter before outputting it back in a frontend pageCVE-2022-2115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting
- Product
- Popup Anything
- Fixed in
- 2.1.7
- What to do
- Update Popup Anything to 2.1.7 or newer.
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- BookingPress
- Fixed in
- 1.0.11
- What to do
- Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.0
- What to do
- Update Photo Gallery by 10Web to 1.6.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022WP User Frontend: Does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboardCVE-2021-25076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
- Product
- WP User Frontend
- Fixed in
- 3.5.26
- What to do
- Update WP User Frontend to 3.5.26 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Dec 27, 2021WPFront User Role Editor: Does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboardCVE-2021-24984 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- WPFront User Role Editor
- Fixed in
- 3.2.1.11184
- What to do
- Update WPFront User Role Editor to 3.2.1.11184 or newer.
Nov 8, 2021The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with aCVE-2021-24835 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks
- Product
- WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
- Fixed in
- 6.5.12
- What to do
- Update WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible to 6.5.12 or newer.
Nov 8, 2021Storefront Footer Text: Does not sanitize and escape the "Footer Credit Text" added to pagesCVE-2021-24607 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed.
- Product
- Storefront Footer Text
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Storefront Footer Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files: Does not sanitise and escape some of its settings before outputting them in attributesCVE-2021-24736 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.
- Product
- Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files
- Fixed in
- 1.6.57
- What to do
- Update Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files to 1.6.57 or newer.
Oct 11, 2021Simple Social Media Share Buttons: Does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used)CVE-2021-24656 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Social Media Share Buttons
- Fixed in
- 3.2.4
- What to do
- Update Simple Social Media Share Buttons to 3.2.4 or newer.
Oct 11, 2021Frontend Uploader: Does not prevent HTML files from being uploaded via its formCVE-2021-24563 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
- Product
- Frontend Uploader
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Frontend Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 6, 2021WPFront Notification Bar: Does not properly sanitise and escape its settingsCVE-2021-24601 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WPFront Notification Bar
- Fixed in
- 2.1.0.08087
- What to do
- Update WPFront Notification Bar to 2.1.0.08087 or newer.
Aug 30, 2021Sitewide Notice WP: Does not sanitise some of its settings before outputting them in frontend pagesCVE-2021-24592 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Sitewide Notice WP
- Fixed in
- 2.3
- What to do
- Update Sitewide Notice WP to 2.3 or newer.
Aug 23, 2021WPFront Scroll Top: Does not sanitise or escape its Image ALT setting before outputting it attributesCVE-2021-24564 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
- Product
- WPFront Scroll Top
- Fixed in
- 2.0.6.07225
- What to do
- Update WPFront Scroll Top to 2.0.6.07225 or newer.
Aug 16, 2021WPFront Notification Bar: Does not sanitise or escape its Custom CSS settingCVE-2021-24518 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- WPFront Notification Bar
- Fixed in
- 2.0.0.07176
- What to do
- Update WPFront Notification Bar to 2.0.0.07176 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 1, 2021The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super CaCVE-2021-24312 · WordPress plugins & themes · reported by WPScanHigh 7.2
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
- Fixed in
- 1.7.3
- What to do
- Update the plugin to 1.7.3 or newer.
Apr 12, 2021In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcodCVE-2021-24226 · WordPress plugins & themes · reported by WPScanHigh 7.5
In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.
- Product
- AccessAlly
- Fixed in
- 3.5.7
- What to do
- Update AccessAlly to 3.5.7 or newer.
Mar 18, 2021Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php CVE-2021-24139 · WordPress plugins & themes · reported by WPScanCritical 9.8
Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.
- Product
- Photo Gallery (10Web Photo Gallery)
- Fixed in
- 1.5.55
- What to do
- Update Photo Gallery (10Web Photo Gallery) to 1.5.55 or newer.
Oct 10, 2019The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1CVE-2015-9479 · WordPress plugins & themes · reported by MITRECritical 9.8
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
- Product
- ACF-Frontend-Display
- Affected
- up to 2015-07-03
- What to do
- Affects up to 2015-07-03. Update ACF-Frontend-Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.CVE-2019-15111 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
- Product
- wp-front-end-profile
- Fixed in
- 0.2.2
- What to do
- Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.CVE-2019-15110 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
- Product
- wp-front-end-profile
- Fixed in
- 0.2.2
- What to do
- Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.CVE-2017-18540 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
- Product
- weblibrarian
- Fixed in
- 3.4.8.7
- What to do
- Update weblibrarian to 3.4.8.7 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.CVE-2017-18539 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
- Product
- weblibrarian
- Fixed in
- 3.4.8.6
- What to do
- Update weblibrarian to 3.4.8.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.CVE-2017-18538 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
- Product
- weblibrarian
- Fixed in
- 3.4.8.5
- What to do
- Update weblibrarian to 3.4.8.5 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.CVE-2017-18545 · WordPress plugins & themes · reported by MITREHigh 7.5
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
- Product
- invite-anyone
- Fixed in
- 1.3.16
- What to do
- Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 30, 2018The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template CVE-2018-16159 · WordPress plugins & themes · reported by MITRECritical 9.8
The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template request.
- Product
- Gift Vouchers
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Gift Vouchers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comexploit-db.com
Jan 22, 2018The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview CVE-2018-6002 · WordPress plugins & themes · reported by MITREMedium 6.1
The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter).
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddefensecode.comdefensecode.com
Jan 22, 2018The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview paraCVE-2018-6001 · WordPress plugins & themes · reported by MITREMedium 6.1
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter).
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddefensecode.comdefensecode.com
May 21, 2015Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote CVE-2015-3647 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) comemail or (2) comname parameter in a wppa do-comment action.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA)
- Fixed in
- 6.1.3
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) to 6.1.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jan 2, 2015Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2014-9444 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errors[fu-disallowed-mime-type][0][name] parameter to the default URI.
- Product
- Frontend Uploader
- Affected
- 0.9.2 to 0.9.2
- What to do
- Affects 0.9.2 to 0.9.2. Update Frontend Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 29, 2011Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrCVE-2011-4568 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.
- Product
- Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer
- Fixed in
- 1.2.12
- What to do
- Update Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer to 1.2.12 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.