Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
314 results · page 7 of 7
Oct 6, 2016Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05CVE-2015-1000009 · WordPress plugins & themes · reported by MITRECritical 9.1
Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05
- Affected
- 1.05 to 1.05
- What to do
- Affects 1.05 to 1.05. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comvapidlabs.com
Oct 6, 2016Open Proxy in filedownload v1.4 wordpress pluginCVE-2015-1000002 · WordPress plugins & themes · reported by MITREHigh 8.2
Open Proxy in filedownload v1.4 wordpress plugin
- Affected
- 1.4 to 1.4
- What to do
- Affects 1.4 to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
May 21, 2016the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2: Open redirectCVE-2016-2221 · WordPress plugins & themes · reported by security@debian.orgHigh 7.4
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
- Product
- the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2
- Fixed in
- 4.4.2
- What to do
- Update the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 to 4.4.2 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Jul 8, 2015Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redCVE-2015-5461 · WordPress plugins & themes · reported by MITREMedium 6.4
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
- Product
- Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow
- Fixed in
- 5.0.9
- What to do
- Update Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow to 5.0.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 1, 2015Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitraryCVE-2014-1750 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html. NOTE: this was originally reported as a cross-site scripting (XSS) vulnerability, but this may be inaccurate.
- Product
- Nokia Maps & Places
- Affected
- 1.6.6 to 1.6.6
- What to do
- Affects 1.6.6 to 1.6.6. Update Nokia Maps & Places to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 2, 2014Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites andCVE-2014-8754 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the out parameter.
- Product
- Ad-Manager
- Affected
- 1.1.2 to 1.1.2
- What to do
- Affects 1.1.2 to 1.1.2. Update Ad-Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 18, 2014wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrectCVE-2014-5204 · WordPress plugins & themes · reported by MITREMedium 6.8
wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.
- Fixed in
- 3.9.2
- What to do
- Update the plugin to 3.9.2 or newer.
Full record and what to do →NVD recordopenwall.comdebian.org
Mar 28, 2014Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and coCVE-2013-2694 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 5.8
Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the u parameter.
- Product
- WP Symposium
- Affected
- 13.04 to 13.04
- What to do
- Affects 13.04 to 13.04. Update WP Symposium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 12, 2014Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3CVE-2013-1636 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for Joomla!, and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.
- Affected
- up to 4.2.9
- Fixed in
- 1.6.3
- What to do
- Update the plugin to 1.6.3 or newer.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Jan 11, 2013Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arCVE-2012-6499 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.
- Product
- Age Verification
- Affected
- up to 0.4
- What to do
- Affects up to 0.4. Update Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexploit-db.comosvdb.org
Jul 10, 2009The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user accountCVE-2009-2336 · WordPress plugins & themes · reported by MITREMedium 5
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Fixed in
- 2.8.1
- What to do
- Update the plugin to 2.8.1 or newer.
Full record and what to do →NVD recordcorelabs.coresecurity.comsecuritytracker.com
Jul 10, 2009WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote CVE-2009-2335 · WordPress plugins & themes · reported by MITREMedium 5
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Fixed in
- 2.8.1
- What to do
- Update the plugin to 2.8.1 or newer.
Full record and what to do →NVD recordcorelabs.coresecurity.comsecuritytracker.com
Apr 28, 2009wp-admin/upgrade.php in WordPress, probably 2.6.x,: Open redirectCVE-2008-6762 · WordPress plugins & themes · reported by MITREMedium 4.3
Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter.
- Product
- wp-admin/upgrade.php in WordPress, probably 2.6.x,
- What to do
- Update wp-admin/upgrade.php in WordPress, probably 2.6.x, to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Jan 29, 2007The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback serviceCVE-2007-0539 · WordPress plugins & themes · reported by MITREHigh 7.8
The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a large file, which triggers a long download session without a timeout constraint.
- Fixed in
- 2.1
- What to do
- Update the plugin to 2.1 or newer.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.