Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

5,866 results · page 70 of 118

Jun 2, 2020common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_usCVE-2020-13764 · WordPress plugins & themes · reported by MITREHigh 7.5
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
Product
common.php in the Gravity Forms
Fixed in
2.4.9
What to do
Update common.php in the Gravity Forms to 2.4.9 or newer.
Full record and what to do →NVD record docs.gravityforms.com github.com
Jun 2, 2020The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective SerCVE-2019-11843 · WordPress plugins & themes · reported by MITREMedium 6.1
The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).
Product
MailPoet
Fixed in
3.23.2
What to do
Update MailPoet to 3.23.2 or newer.
Full record and what to do →NVD record github.com pluginarchive.com
May 29, 2020The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/CVE-2020-12675 · WordPress plugins & themes · reported by MITREHigh 8.8
The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.
Product
mappress-google-maps-for-wordpress
Fixed in
2.54.6
What to do
Update mappress-google-maps-for-wordpress to 2.54.6 or newer.
Full record and what to do →NVD record blog.alertlogic.com wordpress.org
May 28, 2020An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.CVE-2020-13693 · WordPress plugins & themes · reported by MITRECritical 9.8
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
Product
An unauthenticated privilege-escalation issue exists in the bbPress
Fixed in
2.6.5
What to do
Update An unauthenticated privilege-escalation issue exists in the bbPress to 2.6.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com bbpress.org
May 28, 2020An issue was discovered in the Accordion plugin before 2.2.9 for WordPress.CVE-2020-13644 · WordPress plugins & themes · reported by MITREMedium 5.4
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.
Product
An issue was discovered in the Accordion
Fixed in
2.2.9
What to do
Update An issue was discovered in the Accordion to 2.2.9 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
May 28, 2020An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress.CVE-2020-13643 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
Product
An issue was discovered in the SiteOrigin Page Builder
Fixed in
2.10.16
What to do
Update An issue was discovered in the SiteOrigin Page Builder to 2.10.16 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
May 28, 2020An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress.CVE-2020-13642 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
Product
An issue was discovered in the SiteOrigin Page Builder
Fixed in
2.10.16
What to do
Update An issue was discovered in the SiteOrigin Page Builder to 2.10.16 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
May 28, 2020An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress.CVE-2020-13641 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser.
Product
An issue was discovered in the Real-Time Find and Replace
Fixed in
4.0.2
What to do
Update An issue was discovered in the Real-Time Find and Replace to 4.0.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
May 26, 2020The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=foCVE-2020-13487 · WordPress plugins & themes · reported by MITREMedium 4.8
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
Product
bbPress
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bbpress.org codex.bbpress.org
May 16, 2020An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125.CVE-2020-13126 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.
Product
An issue was discovered in the Elementor Pro
Fixed in
2.9.4
What to do
Update An issue was discovered in the Elementor Pro to 2.9.4 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
May 16, 2020An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-CVE-2020-13125 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.
Product
An issue was discovered in the "Ultimate Addons for Elementor
Fixed in
1.24.2
What to do
Update An issue was discovered in the "Ultimate Addons for Elementor to 1.24.2 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
May 13, 2020WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly CVE-2020-12832 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
Fixed in
4.2.8
What to do
Update the plugin to 4.2.8 or newer.
Full record and what to do →NVD record ctulhu.me plugins.trac.wordpress.org
May 13, 2020The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.CVE-2020-12742 · WordPress plugins & themes · reported by MITREMedium 6.1
The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
Product
iubenda-cookie-law-solution
Fixed in
2.3.5
What to do
Update iubenda-cookie-law-solution to 2.3.5 or newer.
Full record and what to do →NVD record github.com wordpress.org
May 8, 2020A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin.CVE-2020-11530 · WordPress plugins & themes · reported by MITRECritical 9.8
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user.
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
May 7, 2020The iframe plugin before 4.5 for WordPress does not sanitize a URL.CVE-2020-12696 · WordPress plugins & themes · reported by MITREMedium 6.1
The iframe plugin before 4.5 for WordPress does not sanitize a URL.
Product
iframe
Fixed in
4.5
What to do
Update iframe to 4.5 or newer.
Full record and what to do →NVD record guilhermerubert.com wordpress.org
May 6, 2020A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject aCVE-2020-11727 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.
Product
AlgolPlus Advanced Order Export For WooCommerce
Affected
3.1.3 to 3.1.3
What to do
Affects 3.1.3 to 3.1.3. Update AlgolPlus Advanced Order Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
May 5, 2020A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress.CVE-2020-8799 · WordPress plugins & themes · reported by MITREMedium 4.8
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website.
Product
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update A Stored XSS vulnerability has been found in the administration page of the WTI Like Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Apr 30, 2020In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor.CVE-2020-11030 · WordPress plugins & themes · reported by GitHubMedium 6.4
In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com wordpress.org
Apr 30, 2020the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting: In affected versions of WordPress, aCVE-2020-11029 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Product
the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting
What to do
Update the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Apr 30, 2020In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditionsCVE-2020-11028 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Apr 30, 2020In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password.CVE-2020-11027 · WordPress plugins & themes · reported by GitHubMedium 6.1
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com github.com
Apr 30, 2020In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file.CVE-2020-11026 · WordPress plugins & themes · reported by GitHubHigh 8.7
In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Apr 30, 2020the navigation section of Customizer: In affected versions of WordPress, a cross-site scripting (XSS)CVE-2020-11025 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Product
the navigation section of Customizer
What to do
Update the navigation section of Customizer to the newest version.
Full record and what to do →NVD record github.com wordpress.org
Apr 30, 2020LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL InjectionCVE-2020-6010 · WordPress plugins & themes · reported by cve@checkpoint.comHigh 8.8
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
Affected
up to 3.2.6.7
What to do
Affects up to 3.2.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Apr 29, 2020The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.CVE-2020-12462 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
Product
ninja-forms
Fixed in
3.4.24.2
What to do
Update ninja-forms to 3.4.24.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 24, 2020The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request viaCVE-2020-12070 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.
Product
Advanced Woo Search
Affected
up to 1.99
What to do
Affects up to 1.99. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 23, 2020The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query).CVE-2020-12054 · WordPress plugins & themes · reported by MITREMedium 6.1
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.
Product
Catch Breadcrumb
Fixed in
1.5.4
What to do
Update Catch Breadcrumb to 1.5.4 or newer.
Full record and what to do →NVD record cxsecurity.com wpvulndb.com
Apr 22, 2020The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leadinCVE-2020-12077 · WordPress plugins & themes · reported by MITREHigh 8.8
The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leading to remote code execution.
Product
mappress-google-maps-for-wordpress
Fixed in
2.53.9
What to do
Update mappress-google-maps-for-wordpress to 2.53.9 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 22, 2020The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions.CVE-2020-12076 · WordPress plugins & themes · reported by MITREHigh 8.8
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.
Product
data-tables-generator-by-supsystic
Fixed in
1.9.92
What to do
Update data-tables-generator-by-supsystic to 1.9.92 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 22, 2020The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.CVE-2020-12075 · WordPress plugins & themes · reported by MITREHigh 8.8
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.
Product
data-tables-generator-by-supsystic
Fixed in
1.9.92
What to do
Update data-tables-generator-by-supsystic to 1.9.92 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 22, 2020The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.CVE-2020-12074 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.
Product
users-customers-import-export-for-wp-woocommerce
Fixed in
1.3.9
What to do
Update users-customers-import-export-for-wp-woocommerce to 1.3.9 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 22, 2020The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.CVE-2020-12073 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.
Product
responsive-add-ons
Fixed in
2.2.7
What to do
Update responsive-add-ons to 2.2.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 19, 2020The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link.CVE-2020-11930 · WordPress plugins & themes · reported by MITREMedium 6.1
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.
Product
GTranslate
Fixed in
2.8.52
What to do
Update GTranslate to 2.8.52 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 19, 2020In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gCVE-2020-11928 · WordPress plugins & themes · reported by MITRECritical 9.8
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.
Product
In the media-library-assistant
Fixed in
2.82
What to do
Update In the media-library-assistant to 2.82 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 13, 2020WordPress Snap Creek Duplicator Plugin File Download VulnerabilityCVE-2020-11738 · WordPress plugins & themes · reported by MITREExploitedHigh 7.5
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Product
Snap Creek Duplicator Plugin
Fixed in
1.3.28
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 13, 2020An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress.CVE-2020-11673 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view a hidden poll. This is due to the usage of the callback wp_ajax_nopriv function in Includes/Total-Soft-Poll-Ajax.php for sensitive operations.
Product
An issue was discovered in the Responsive Poll
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update An issue was discovered in the Responsive Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordpress.org
Apr 12, 2020The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.CVE-2020-11732 · WordPress plugins & themes · reported by MITREHigh 7.5
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.
Product
Media Library Assistant
Fixed in
2.82
What to do
Update Media Library Assistant to 2.82 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 12, 2020The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allowCVE-2020-11731 · WordPress plugins & themes · reported by MITREMedium 6.1
The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allow remote authenticated users to execute arbitrary JavaScript.
Product
Media Library Assistant
Fixed in
2.82
What to do
Update Media Library Assistant to 2.82 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 7, 2020An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript viCVE-2020-11509 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page).
Product
An XSS vulnerability in the WP Lead Plus X
Affected
up to 0.98
What to do
Affects up to 0.98. Update An XSS vulnerability in the WP Lead Plus X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pagesCVE-2020-11508 · WordPress plugins & themes · reported by MITREMedium 5.4
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pages with a malicious page containing arbitrary JavaScript via the wp_ajax_core37_lp_save_page (aka core37_lp_save_page) AJAX action.
Product
An XSS vulnerability in the WP Lead Plus X
Affected
up to 0.98
What to do
Affects up to 0.98. Update An XSS vulnerability in the WP Lead Plus X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress.CVE-2020-9514 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subscriber role) to permanently delete arbitrary posts and pages, create new posts with arbitrary subjects, and modify the subjects of existing posts and pages (via create_dynamic_page and delete_dynamic_page).
Product
An issue was discovered in the IMPress for IDX Broker
Fixed in
2.6.2
What to do
Update An issue was discovered in the IMPress for IDX Broker to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 7, 2020Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScrCVE-2020-11516 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
Product
Stored XSS in the Contact Form 7 Datepicker
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Stored XSS in the Contact Form 7 Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the uCVE-2020-11515 · WordPress plugins & themes · reported by MITREMedium 6.1
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
Product
Rank Math
Affected
up to 1.0.40.2
What to do
Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record rankmath.com wordpress.org
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escCVE-2020-11514 · WordPress plugins & themes · reported by MITRECritical 9.8
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
Product
Rank Math
Affected
up to 1.0.40.2
What to do
Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record rankmath.com wordpress.org
Apr 7, 2020Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrCVE-2020-11512 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts.
Product
IMPress for IDX Broker
Fixed in
2.6.2
What to do
Update IMPress for IDX Broker to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 4, 2020The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula.CVE-2020-11548 · WordPress plugins & themes · reported by MITRECritical 9.8
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
Product
Search Meter
Affected
up to 2.13.2
What to do
Affects up to 2.13.2. Update Search Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org exploit-db.com
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.CVE-2019-17231 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
Product
includes/theme-functions.php in the OneTone
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.CVE-2019-17230 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
Product
includes/theme-functions.php in the OneTone
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Apr 1, 2020LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.CVE-2020-6009 · WordPress plugins & themes · reported by cve@checkpoint.comCritical 9.8
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.
Fixed in
3.1.6
What to do
Update the plugin to 3.1.6 or newer.
Full record and what to do →NVD record learndash.releasenotes.io learndash.releasenotes.io
Apr 1, 2020An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.CVE-2020-7948 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.
Product
An issue was discovered in the Login by Auth0
Fixed in
4.0.0
What to do
Update An issue was discovered in the Login by Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com auth0.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.