Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

4,893 results · page 71 of 98

Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.CVE-2015-9329 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.CVE-2015-9318 · WordPress plugins & themes · reported by MITREHigh 7.5
The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.
Product
awesome-support
Fixed in
3.1.7
What to do
Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.CVE-2015-9317 · WordPress plugins & themes · reported by MITREMedium 6.1
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
Product
awesome-support
Fixed in
3.1.7
What to do
Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.CVE-2014-10381 · WordPress plugins & themes · reported by MITREHigh 8.8
The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.
Product
user-domain-whitelist
Fixed in
1.5
What to do
Update user-domain-whitelist to 1.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-access-manager plugin before 1.2 for WordPress has CSRF.CVE-2011-5328 · WordPress plugins & themes · reported by MITREHigh 8.8
The user-access-manager plugin before 1.2 for WordPress has CSRF.
Product
user-access-manager
Fixed in
1.2
What to do
Update user-access-manager to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.CVE-2019-15082 · WordPress plugins & themes · reported by MITREMedium 6.1
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.
Product
360-product-rotation
Fixed in
1.4.8
What to do
Update 360-product-rotation to 1.4.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.CVE-2019-15116 · WordPress plugins & themes · reported by MITREMedium 6.1
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
Product
easy-digital-downloads
Fixed in
2.9.16
What to do
Update easy-digital-downloads to 2.9.16 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.CVE-2019-15115 · WordPress plugins & themes · reported by MITREHigh 8.8
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
Product
peters-login-redirect
Fixed in
2.9.2
What to do
Update peters-login-redirect to 2.9.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.CVE-2019-15114 · WordPress plugins & themes · reported by MITREHigh 8.8
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
Product
formcraft-form-builder
Fixed in
1.2.2
What to do
Update formcraft-form-builder to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.CVE-2019-15113 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
Product
companion-sitemap-generator
Fixed in
3.7.0
What to do
Update companion-sitemap-generator to 3.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The js-jobs plugin before 1.0.7 for WordPress has CSRF.CVE-2018-20974 · WordPress plugins & themes · reported by MITREHigh 8.8
The js-jobs plugin before 1.0.7 for WordPress has CSRF.
Product
js-jobs
Fixed in
1.0.7
What to do
Update js-jobs to 1.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.CVE-2018-20973 · WordPress plugins & themes · reported by MITRECritical 9.8
The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.CVE-2018-20972 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.CVE-2018-20971 · WordPress plugins & themes · reported by MITREHigh 8.8
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
Product
church-admin
Fixed in
1.2550
What to do
Update church-admin to 1.2550 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.CVE-2017-18547 · WordPress plugins & themes · reported by MITREHigh 8.8
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
Product
nelio-ab-testing
Fixed in
4.6.4
What to do
Update nelio-ab-testing to 4.6.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.CVE-2017-18546 · WordPress plugins & themes · reported by MITREHigh 8.8
The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
Product
jayj-quicktag
Fixed in
1.3.2
What to do
Update jayj-quicktag to 1.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.CVE-2017-18545 · WordPress plugins & themes · reported by MITREHigh 7.5
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.CVE-2017-18544 · WordPress plugins & themes · reported by MITREHigh 8.8
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.CVE-2017-18543 · WordPress plugins & themes · reported by MITRECritical 9.8
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18542 · WordPress plugins & themes · reported by MITREMedium 6.1
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
zendesk-help-center
Fixed in
1.0.5
What to do
Update zendesk-help-center to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The xo-security plugin before 1.5.3 for WordPress has XSS.CVE-2017-18541 · WordPress plugins & themes · reported by MITREMedium 6.1
The xo-security plugin before 1.5.3 for WordPress has XSS.
Product
xo-security
Fixed in
1.5.3
What to do
Update xo-security to 1.5.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.CVE-2015-9324 · WordPress plugins & themes · reported by MITRECritical 9.8
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Product
easy-digital-downloads
Fixed in
2.3.3
What to do
Update easy-digital-downloads to 2.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.CVE-2015-9323 · WordPress plugins & themes · reported by MITRECritical 9.8
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Product
404-to-301
Fixed in
2.0.3
What to do
Update 404-to-301 to 2.0.3 or newer.
Full record and what to do →NVD record github.com wordpress.org
Aug 16, 2019The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.CVE-2015-9322 · WordPress plugins & themes · reported by MITREHigh 8.8
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Product
erident-custom-login-and-dashboard
Fixed in
3.5
What to do
Update erident-custom-login-and-dashboard to 3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.CVE-2014-10376 · WordPress plugins & themes · reported by MITRECritical 9.8
The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
Product
i-recommend-this
Fixed in
3.7.3
What to do
Update i-recommend-this to 3.7.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The note-press plugin before 0.1.2 for WordPress has SQL injection.CVE-2017-18548 · WordPress plugins & themes · reported by MITRECritical 9.8
The note-press plugin before 0.1.2 for WordPress has SQL injection.
Product
note-press
Fixed in
0.1.2
What to do
Update note-press to 0.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The olimometer plugin before 2.57 for WordPress has SQL injection.CVE-2016-10904 · WordPress plugins & themes · reported by MITRECritical 9.8
The olimometer plugin before 2.57 for WordPress has SQL injection.
Product
olimometer
Fixed in
2.57
What to do
Update olimometer to 2.57 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.CVE-2015-9326 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
Product
wp-business-intelligence-lite
Fixed in
1.6.3
What to do
Update wp-business-intelligence-lite to 1.6.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The visitors-online plugin before 0.4 for WordPress has SQL injection.CVE-2015-9325 · WordPress plugins & themes · reported by MITRECritical 9.8
The visitors-online plugin before 0.4 for WordPress has SQL injection.
Product
visitors-online
Fixed in
0.4
What to do
Update visitors-online to 0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.CVE-2019-14789 · WordPress plugins & themes · reported by MITREMedium 6.1
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
Affected
3.2.8 to 3.2.8
What to do
Affects 3.2.8 to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 15, 2019wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultCVE-2019-14788 · WordPress plugins & themes · reported by MITREHigh 8.8
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
Product
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters
Fixed in
4.6.19
What to do
Update wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.CVE-2019-14786 · WordPress plugins & themes · reported by MITREMedium 6.5
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.
Fixed in
1.0.27.1
What to do
Update the plugin to 1.0.27.1 or newer.
Full record and what to do →NVD record rankmath.com wpvulndb.com
Aug 15, 2019The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.CVE-2019-14784 · WordPress plugins & themes · reported by MITREMedium 6.1
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
Product
CP Contact Form with PayPal
Fixed in
1.2.98
What to do
Update CP Contact Form with PayPal to 1.2.98 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress.CVE-2019-13578 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Product
A SQL injection vulnerability exists in the Impress GiveWP Give
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update A SQL injection vulnerability exists in the Impress GiveWP Give to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Aug 15, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-pCVE-2019-14800 · WordPress plugins & themes · reported by MITREMedium 5.3
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.
Product
FV Flowplayer Video Player
Fixed in
7.3.15.727
What to do
Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 15, 2019The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked CVE-2019-14795 · WordPress plugins & themes · reported by MITREMedium 4.8
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,CVE-2019-14790 · WordPress plugins & themes · reported by MITREMedium 6.1
The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress.CVE-2019-14216 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file.
Product
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons)
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com zeroauth.ltd
Aug 14, 2019The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.CVE-2018-20968 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.
Product
wp-ultimate-exporter
Fixed in
1.4.2
What to do
Update wp-ultimate-exporter to 1.4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.CVE-2018-20967 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
Product
wp-ultimate-csv-importer
Fixed in
5.6.1
What to do
Update wp-ultimate-csv-importer to 5.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.CVE-2017-18513 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
Product
responsive-menu
Fixed in
3.1.4
What to do
Update responsive-menu to 3.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.CVE-2017-18512 · WordPress plugins & themes · reported by MITREHigh 8.8
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
Product
newsletter-by-supsystic
Fixed in
1.1.8
What to do
Update newsletter-by-supsystic to 1.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.CVE-2017-18511 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
Product
custom-sidebars
Fixed in
3.0.8.1
What to do
Update custom-sidebars to 3.0.8.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.CVE-2016-10888 · WordPress plugins & themes · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.7
What to do
Update all-in-one-wp-security-and-firewall to 4.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.CVE-2016-10887 · WordPress plugins & themes · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.9
What to do
Update all-in-one-wp-security-and-firewall to 4.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.CVE-2016-10886 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
Product
wp-editor
Fixed in
1.2.6
What to do
Update wp-editor to 1.2.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-editor plugin before 1.2.6 for WordPress has CSRF.CVE-2016-10885 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
Product
wp-editor
Fixed in
1.2.6
What to do
Update wp-editor to 1.2.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.CVE-2016-10884 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Product
simple-membership
Fixed in
3.3.3
What to do
Update simple-membership to 3.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.CVE-2016-10883 · WordPress plugins & themes · reported by MITREMedium 6.5
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
Product
simple-add-pages-or-posts
Fixed in
1.7
What to do
Update simple-add-pages-or-posts to 1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.