Vulnerability database

304 results · page 7 of 7

• Aug 20, 2017The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() iCVE-2017-12977 · WordPress plugins & themes · reported by MITREHigh 7.2

  The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.

  Product

  Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery

  Fixed in

  1.3.51

  What to do

  Update Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery to 1.3.51 or newer.

  Full record and what to do →NVD recordgithub.comwordpress.org

• Jul 7, 2017Responsive Lightbox prior to version 1.7.2: Cross-site scriptingCVE-2017-2243 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1

  Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

  Product

  Responsive Lightbox prior to version 1.7.2

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Responsive Lightbox prior to version 1.7.2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordjvn.jpsecurityfocus.com

• Jul 2, 2014Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbiCVE-2014-4594 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.

  Product

  Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview

  Fixed in

  1.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview to 1.2 or newer.

  Full record and what to do →NVD recordcodevigilant.comwordpress.org

• Mar 14, 2014the Responsive Logo Slideshow plugin for: Cross-site scripting (XSS)CVE-2013-1759 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the "URL and Image" field.

  Product

  the Responsive Logo Slideshow plugin for

  What to do

  Update the Responsive Logo Slideshow plugin for to the newest version.

  Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.