Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
317 results · page 7 of 7
Apr 9, 2018The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.CVE-2018-9864 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.
- Product
- WP Live Chat Support
- Fixed in
- 8.0.06
- What to do
- Update WP Live Chat Support to 8.0.06 or newer.
Full record and what to do →NVD recordwordpress.orggubello.me
Mar 19, 2018Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject CVE-2014-2297 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.
- Product
- VideoWhisper Live Streaming Integration
- Affected
- 4.29.6 to 4.29.6
- What to do
- Affects 4.29.6 to 4.29.6. Update VideoWhisper Live Streaming Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jun 9, 2017WP Live Chat Support prior to version 7.0.07: Cross-site scriptingCVE-2017-2187 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- WP Live Chat Support prior to version 7.0.07
- Affected
- up to 7.0.06
- What to do
- Affects up to 7.0.06. Update WP Live Chat Support prior to version 7.0.07 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org
Feb 20, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the CVE-2015-2039 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.
- Product
- Acobot Live Chat & Contact Form
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update Acobot Live Chat & Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Jan 13, 2015Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentCVE-2014-100001 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information.
- Product
- Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim
- Fixed in
- 1.1.4-free
- What to do
- Update Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim to 1.1.4-free or newer.
Full record and what to do →NVD recordsecunia.comexchange.xforce.ibmcloud.com
Dec 31, 2014Cross-site request forgery (CSRF) vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hijack the authenticatCVE-2014-9398 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the mashtlb_twitter_username parameter in the twitter-liveblog.php page to wp-admin/options-general.php.
- Product
- Twitter LiveBlog
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Twitter LiveBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 29, 2014The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4CVE-2014-1908 · WordPress plugins & themes · reported by MITREMedium 5
The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
- Fixed in
- 4.29.5
- What to do
- Update the plugin to 4.29.5 or newer.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Dec 29, 2014Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote atCVE-2014-1905 · WordPress plugins & themes · reported by MITREHigh 10
Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
- Product
- Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration
- Fixed in
- 4.29.5
- What to do
- Update Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration to 4.29.5 or newer.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for WordPress allows remote CVE-2014-4540 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
- Product
- Oleggo LiveStream
- Affected
- up to 0.2.6
- What to do
- Affects up to 0.2.6. Update Oleggo LiveStream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in ls/vv_login.php in the VideoWhisper Live Streaming Integration plugin 4.27.2 and earlier for WordPress allows remoteCVE-2014-4569 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in ls/vv_login.php in the VideoWhisper Live Streaming Integration plugin 4.27.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the room_name parameter.
- Product
- VideoWhisper Live Streaming Integration
- Affected
- up to 4.27.2
- What to do
- Affects up to 4.27.2. Update VideoWhisper Live Streaming Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comsecurityfocus.com
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow reCVE-2014-4513 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter.
- Product
- ActiveHelper LiveHelp Live Chat
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update ActiveHelper LiveHelp Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Mar 6, 2014Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) reaCVE-2014-1907 · WordPress plugins & themes · reported by MITREMedium 6.4
Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.
- Product
- Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration
- Fixed in
- 4.29.5
- What to do
- Update Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration to 4.29.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Mar 6, 2014Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to CVE-2014-1906 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration
- Fixed in
- 4.29.5
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration to 4.29.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Sep 9, 2013Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WorCVE-2013-5714 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) message parameter. NOTE: some of these details are obtained from third party information.
- Product
- VideoWhisper Live Streaming Integration
- What to do
- Update VideoWhisper Live Streaming Integration to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Oct 9, 2012wp-live.php in the WP Live.php module 1.2.1 for: Cross-site scripting (XSS)CVE-2012-5346 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter. NOTE: some of these details are obtained from third party information.
- Product
- wp-live.php in the WP Live.php module 1.2.1 for
- What to do
- Update wp-live.php in the WP Live.php module 1.2.1 for to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.orgsecurityfocus.com
Sep 20, 2012clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for: Cross-site scripting (XSS)CVE-2011-5181 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter. NOTE: some of these details are obtained from third party information.
- Product
- clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for
- What to do
- Update clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for to the newest version.
Full record and what to do →NVD recordosvdb.orgwordpress.org
Feb 4, 2008cforms-css.php in Oliver Seidel cforms: PHP remote file inclusionCVE-2008-0560 · WordPress plugins & themes · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in cforms-css.php in Oliver Seidel cforms (contactforms), a Wordpress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the tm parameter. NOTE: CVE disputes this issue for 7.3, since there is no tm parameter, and the code exits with a fatal error due to a call to an undefined function
- Product
- cforms-css.php in Oliver Seidel cforms
- What to do
- Update cforms-css.php in Oliver Seidel cforms to the newest version.
Full record and what to do →NVD recordsecurityreason.comattrition.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.