Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

541new WordPress flaws this week

391,528entries in the database

4,893 results · page 70 of 98

Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.CVE-2016-10909 · WordPress plugins & themes · reported by MITRECritical 9.8
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.CVE-2016-10908 · WordPress plugins & themes · reported by MITREMedium 6.1
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.CVE-2016-10903 · WordPress plugins & themes · reported by MITREHigh 8.8
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
Product
GoDaddy godaddy-email-marketing-sign-up-forms
Fixed in
1.1.3
What to do
Update GoDaddy godaddy-email-marketing-sign-up-forms to 1.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.CVE-2016-10902 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
Product
wp-customer-reviews
Fixed in
3.0.9
What to do
Update wp-customer-reviews to 3.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.CVE-2016-10901 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
Product
wp-customer-reviews
Fixed in
3.0.9
What to do
Update wp-customer-reviews to 3.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The uji-countdown plugin before 2.0.7 for WordPress has XSS.CVE-2016-10900 · WordPress plugins & themes · reported by MITREMedium 6.1
The uji-countdown plugin before 2.0.7 for WordPress has XSS.
Product
uji-countdown
Fixed in
2.0.7
What to do
Update uji-countdown to 2.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.CVE-2019-15109 · WordPress plugins & themes · reported by MITREMedium 6.1
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
Product
the-events-calendar
Fixed in
4.8.2
What to do
Update the-events-calendar to 4.8.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.CVE-2017-18540 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.7
What to do
Update weblibrarian to 3.4.8.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.CVE-2017-18539 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.6
What to do
Update weblibrarian to 3.4.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.CVE-2017-18538 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.5
What to do
Update weblibrarian to 3.4.8.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.CVE-2017-18537 · WordPress plugins & themes · reported by MITREMedium 6.1
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
Product
visitors-online
Fixed in
1.0.0
What to do
Update visitors-online to 1.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.CVE-2017-18536 · WordPress plugins & themes · reported by MITREMedium 6.1
The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
Product
stop-user-enumeration
Fixed in
1.3.8
What to do
Update stop-user-enumeration to 1.3.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.CVE-2017-18534 · WordPress plugins & themes · reported by MITREMedium 6.1
The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
Product
share-on-diaspora
Fixed in
0.7.2
What to do
Update share-on-diaspora to 0.7.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.CVE-2016-10899 · WordPress plugins & themes · reported by MITREMedium 5.3
The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
Product
total-security
Fixed in
3.4.1
What to do
Update total-security to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The total-security plugin before 3.4.1 for WordPress has XSS.CVE-2016-10898 · WordPress plugins & themes · reported by MITREMedium 6.1
The total-security plugin before 3.4.1 for WordPress has XSS.
Product
total-security
Fixed in
3.4.1
What to do
Update total-security to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.CVE-2016-10897 · WordPress plugins & themes · reported by MITREMedium 6.1
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
Product
sermon-browser
Fixed in
0.45.16
What to do
Update sermon-browser to 0.45.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The seo-redirection plugin before 4.3 for WordPress has stored XSS.CVE-2016-10896 · WordPress plugins & themes · reported by MITREMedium 6.1
The seo-redirection plugin before 4.3 for WordPress has stored XSS.
Product
seo-redirection
Fixed in
4.3
What to do
Update seo-redirection to 4.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.CVE-2015-9321 · WordPress plugins & themes · reported by MITREMedium 6.1
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Product
shortcode-factory
Fixed in
1.1.1
What to do
Update shortcode-factory to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.4.7 for WordPress has XSS.CVE-2018-20978 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.7
What to do
Update wp-all-import to 3.4.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.CVE-2017-18566 · WordPress plugins & themes · reported by MITREMedium 6.1
The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
Product
user-role
Fixed in
1.5.6
What to do
Update user-role to 1.5.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.CVE-2017-18533 · WordPress plugins & themes · reported by MITREMedium 6.1
The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
Product
rimons-twitter-widget
Fixed in
1.3
What to do
Update rimons-twitter-widget to 1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The realty plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18532 · WordPress plugins & themes · reported by MITREMedium 6.1
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
realty
Fixed in
1.1.0
What to do
Update realty to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.CVE-2017-18531 · WordPress plugins & themes · reported by MITREMedium 6.1
The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
Product
raygun4wp
Fixed in
1.8.3
What to do
Update raygun4wp to 1.8.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.CVE-2017-18530 · WordPress plugins & themes · reported by MITREMedium 6.1
The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
Product
rating-bws
Fixed in
0.2
What to do
Update rating-bws to 0.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.CVE-2017-18529 · WordPress plugins & themes · reported by MITREMedium 6.1
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
Product
promobar
Fixed in
1.1.1
What to do
Update promobar to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.CVE-2017-18528 · WordPress plugins & themes · reported by MITREMedium 6.1
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
Product
pdf-print
Fixed in
1.9.4
What to do
Update pdf-print to 1.9.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.CVE-2017-18527 · WordPress plugins & themes · reported by MITREMedium 6.1
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
Product
pagination
Fixed in
1.0.7
What to do
Update pagination to 1.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The moreads-se plugin before 1.4.7 for WordPress has XSS.CVE-2017-18526 · WordPress plugins & themes · reported by MITREMedium 6.1
The moreads-se plugin before 1.4.7 for WordPress has XSS.
Product
moreads-se
Fixed in
1.4.7
What to do
Update moreads-se to 1.4.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.CVE-2017-18524 · WordPress plugins & themes · reported by MITREMedium 6.1
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
Product
football-pool
Fixed in
2.6.5
What to do
Update football-pool to 2.6.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.CVE-2017-18523 · WordPress plugins & themes · reported by MITREHigh 8.8
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
Product
eelv-newsletter
Fixed in
4.6.1
What to do
Update eelv-newsletter to 4.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.CVE-2017-18522 · WordPress plugins & themes · reported by MITREMedium 6.1
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
Product
eelv-newsletter
Fixed in
4.6.1
What to do
Update eelv-newsletter to 4.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.CVE-2017-18519 · WordPress plugins & themes · reported by MITREMedium 6.1
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
Product
customer-area
Fixed in
7.4.3
What to do
Update customer-area to 7.4.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18518 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
bws-smtp
Fixed in
1.1.0
What to do
Update bws-smtp to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.CVE-2016-10895 · WordPress plugins & themes · reported by MITREMedium 6.1
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
Product
option-tree
Fixed in
2.6.0
What to do
Update option-tree to 2.6.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.CVE-2016-10892 · WordPress plugins & themes · reported by MITREMedium 6.1
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
Product
chained-quiz
Fixed in
1.0
What to do
Update chained-quiz to 1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.CVE-2015-9320 · WordPress plugins & themes · reported by MITREMedium 6.1
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
Product
option-tree
Fixed in
2.5.4
What to do
Update option-tree to 2.5.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.CVE-2015-9319 · WordPress plugins & themes · reported by MITREMedium 6.1
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Product
gregs-high-performance-seo
Fixed in
1.6.2
What to do
Update gregs-high-performance-seo to 1.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-15238 · WordPress plugins & themes · reported by MITREHigh 8.8
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
Product
cforms2
Fixed in
15.0.2
What to do
Update cforms2 to 15.0.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.CVE-2017-18569 · WordPress plugins & themes · reported by MITREHigh 8.8
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
Product
my-wp-translate
Fixed in
1.0.4
What to do
Update my-wp-translate to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The my-wp-translate plugin before 1.0.4 for WordPress has XSS.CVE-2017-18568 · WordPress plugins & themes · reported by MITREMedium 6.1
The my-wp-translate plugin before 1.0.4 for WordPress has XSS.
Product
my-wp-translate
Fixed in
1.0.4
What to do
Update my-wp-translate to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.4.6 for WordPress has XSS.CVE-2017-18567 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.6
What to do
Update wp-all-import to 3.4.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.CVE-2017-18520 · WordPress plugins & themes · reported by MITREMedium 6.1
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
Product
democracy-poll
Fixed in
5.4
What to do
Update democracy-poll to 5.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 20, 2019The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18517 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
bws-pinterest
Fixed in
1.0.5
What to do
Update bws-pinterest to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.CVE-2016-10915 · WordPress plugins & themes · reported by MITREHigh 8.8
The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
Product
popup-by-supsystic
Fixed in
1.7.9
What to do
Update popup-by-supsystic to 1.7.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.CVE-2016-10914 · WordPress plugins & themes · reported by MITREHigh 8.8
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
Product
add-from-server
Fixed in
3.3.2
What to do
Update add-from-server to 3.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.CVE-2016-10913 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
Product
wp-latest-posts
Fixed in
3.7.5
What to do
Update wp-latest-posts to 3.7.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.CVE-2016-10893 · WordPress plugins & themes · reported by MITREMedium 6.1
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
Product
crayon-syntax-highlighter
Fixed in
2.8.4
What to do
Update crayon-syntax-highlighter to 2.8.4 or newer.
Full record and what to do →NVD record github.com github.com
Aug 20, 2019The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.CVE-2015-9332 · WordPress plugins & themes · reported by MITREMedium 6.5
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Product
uninstall
Fixed in
1.2
What to do
Update uninstall to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Product
wp-all-import
Fixed in
3.2.4
What to do
Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.CVE-2015-9330 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.