Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

345 results · page 7 of 7

Nov 8, 2021Post Content XMLRPC: Does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboardCVE-2021-24629 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
Product
Post Content XMLRPC
Affected
up to 1.0
What to do
Affects up to 1.0. Update Post Content XMLRPC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Oct 25, 2021YOP Poll: Does not escape the perpage parameter before outputting it back in an attributeCVE-2021-24885 · WordPress plugins & themes · reported by WPScanMedium 6.1
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
YOP Poll
Fixed in
6.1.2
What to do
Update YOP Poll to 6.1.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Aug 16, 2021Wonder PDF Embed: Does not escape parameters of its wonderplugin_pdf shortcodeCVE-2021-24541 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
Product
Wonder PDF Embed
Fixed in
1.7
What to do
Update Wonder PDF Embed to 1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Wonder Video Embed: Does not escape parameters of its wonderplugin_video shortcodeCVE-2021-24540 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
Product
Wonder Video Embed
Fixed in
1.8
What to do
Update Wonder Video Embed to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2021In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $CVE-2021-34630 · WordPress plugins & themes · reported by WordfenceMedium 5
In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jul 7, 2021A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible fCVE-2021-34622 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ pageCVE-2021-24319 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue
Product
Bello - Directory & Listing
Fixed in
1.6.0
What to do
Update Bello - Directory & Listing to 1.6.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 5, 2021Elementor Addons – PowerPack Addons for Elementor: For WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24263 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addons – PowerPack Addons for Elementor
Fixed in
2.3.2
What to do
Update Elementor Addons – PowerPack Addons for Elementor to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Mar 18, 2021Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast CVE-2021-24123 · WordPress plugins & themes · reported by WPScanHigh 7.2
Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), allowing high privilege accounts (admin+) being able to upload arbitrary files, such as php, leading to RCE.
Product
PowerPress
Fixed in
8.3.8
What to do
Update PowerPress to 8.3.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 2, 2020wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.CVE-2020-28036 · WordPress plugins & themes · reported by MITRECritical 9.8
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record github.com lists.debian.org
Nov 2, 2020WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.CVE-2020-28035 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record lists.debian.org lists.fedoraproject.org
Oct 17, 2019WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series CVE-2019-17669 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org core.trac.wordpress.org
Sep 25, 2019The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.CVE-2015-9410 · WordPress plugins & themes · reported by MITREMedium 5.4
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.
Affected
6.0.4 to 6.0.4
What to do
Affects 6.0.4 to 6.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com github.com
Sep 16, 2019The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.CVE-2016-10970 · WordPress plugins & themes · reported by MITREMedium 6.1
The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.
Product
supportflow
Fixed in
0.7
What to do
Update supportflow to 0.7 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 4, 2019cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_desCVE-2019-14470 · WordPress plugins & themes · reported by MITREMedium 6.1
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
Product
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro
Affected
up to 4.9.32
What to do
Affects up to 4.9.32. Update cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.CVE-2019-15825 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
Product
wps-hide-login
Fixed in
1.5.3
What to do
Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 8, 2019core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.CVE-2019-14679 · WordPress plugins & themes · reported by MITREMedium 6.5
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
Product
ARPrice Lite
Affected
2.2 to 2.2
What to do
Affects 2.2 to 2.2. Update ARPrice Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
May 1, 2019HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fakCVE-2019-11633 · WordPress plugins & themes · reported by MITREHigh 7.5
HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fake WordPress templates. This allows attackers to discover and avoid this honeypot system.
Affected
up to 2016-09-27
What to do
Affects up to 2016-09-27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call.CVE-2018-20148 · WordPress plugins & themes · reported by MITRECritical 9.8
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com blog.secarma.co.uk
Sep 6, 2018The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.CVE-2018-16285 · WordPress plugins & themes · reported by MITREMedium 6.1
The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.
Product
UserPro
Affected
up to 4.9.23
What to do
Affects up to 4.9.23. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record risataim.blogspot.com wpvulndb.com
Jan 9, 2018The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt CVE-2018-5311 · WordPress plugins & themes · reported by MITREMedium 5.4
The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt URI.
Affected
2.4.6 to 2.4.6
What to do
Affects 2.4.6 to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Nov 9, 2017The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain admCVE-2017-16562 · WordPress plugins & themes · reported by MITRECritical 9.8
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
Product
UserPro
Fixed in
4.9.17.1
What to do
Update UserPro to 4.9.17.1 or newer.
Full record and what to do →NVD record codecanyon.net wpvulndb.com
Sep 27, 2017Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.CVE-2017-14842 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
May 23, 2017upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variabCVE-2015-5682 · WordPress plugins & themes · reported by MITREHigh 7.5
upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com vapid.dhs.org
May 18, 2017In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.CVE-2017-9065 · WordPress plugins & themes · reported by MITREHigh 7.5
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 18, 2017In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.CVE-2017-9062 · WordPress plugins & themes · reported by MITREHigh 8.6
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 21, 2016The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypassCVE-2015-5715 · WordPress plugins & themes · reported by MITREMedium 4.3
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
Fixed in
4.3.1
What to do
Update the plugin to 4.3.1 or newer.
Full record and what to do →NVD record debian.org debian.org
Aug 18, 2015Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploCVE-2015-5681 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 18, 2015Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands CVE-2015-5599 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 5, 2015Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.CVE-2015-2218 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
Fixed in
2.1
What to do
Update the plugin to 2.1 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Mar 3, 2015Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrarCVE-2015-2199 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player
Fixed in
2.1
What to do
Update Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player to 2.1 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Feb 2, 2015Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web CVE-2015-1385 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting
Fixed in
6.0.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting to 6.0.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 18, 2014The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in anCVE-2014-5266 · WordPress plugins & themes · reported by MITREMedium 5
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
Fixed in
3.9.2
What to do
Update the plugin to 3.9.2 or newer.
Full record and what to do →NVD record cgit.drupalcode.org cgit.drupalcode.org
Aug 18, 2014The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without consideCVE-2014-5265 · WordPress plugins & themes · reported by MITREMedium 5
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Fixed in
3.9.2
What to do
Update the plugin to 3.9.2 or newer.
Full record and what to do →NVD record cgit.drupalcode.org debian.org
Jan 20, 2014wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated userCVE-2012-6635 · WordPress plugins & themes · reported by MITREMedium 4
wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft.
Fixed in
3.3.3
What to do
Update the plugin to 3.3.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jul 8, 2013The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a cCVE-2013-0235 · WordPress plugins & themes · reported by Red HatMedium 6.4
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
Fixed in
3.5.1
What to do
Update the plugin to 3.5.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Sep 14, 2012The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users toCVE-2010-5106 · WordPress plugins & themes · reported by Red HatMedium 6.5
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.
Fixed in
3.0.3
What to do
Update the plugin to 3.0.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Aug 15, 2012Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module before 3.2 for WordPress allow remote attackers to inject arbCVE-2012-3434 · WordPress plugins & themes · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module before 3.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) datemin, or (3) datemax parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module
Fixed in
3.2
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module to 3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
May 21, 2012Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows rCVE-2012-2920 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo
Fixed in
0.9.5.2
What to do
Update Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo to 0.9.5.2 or newer.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Feb 7, 2008The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via uCVE-2008-0664 · WordPress plugins & themes · reported by MITREMedium 6.4
The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via unknown vectors.
Fixed in
2.3.3
What to do
Update the plugin to 2.3.3 or newer.
Full record and what to do →NVD record secunia.com secunia.com
Jun 8, 2007xmlrpc.php in WordPress 2.2: SQL injectionCVE-2007-3140 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.
Product
xmlrpc.php in WordPress 2.2
What to do
Update xmlrpc.php in WordPress 2.2 to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 9, 2007xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictionsCVE-2007-1893 · WordPress plugins & themes · reported by MITREMedium 4.9
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com secunia.com
Apr 9, 2007xmlrpc: SQL injectionCVE-2007-1897 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the post_id variable.
Product
xmlrpc
What to do
Update xmlrpc to the newest version.
Full record and what to do →NVD record secunia.com secunia.com
Jul 5, 2005PEAR XML_RPC 1.3.0 and earlier: Eval injectionCVE-2005-1921 · WordPress plugins & themes · reported by Red HatHigh 7.5
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Product
PEAR XML_RPC 1.3.0 and earlier
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update PEAR XML_RPC 1.3.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record marc.info marc.info
Jul 5, 2005XMLRPC server in WordPress 1.5.1.2 and earlier: SQL injectionCVE-2005-2108 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTP_RAW_POST_DATA variable, which stores the data in an XML file.
Product
XMLRPC server in WordPress 1.5.1.2 and earlier
Affected
up to 1.5.1.2
What to do
Affects up to 1.5.1.2. Update XMLRPC server in WordPress 1.5.1.2 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record marc.info secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.