Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

4,893 results · page 72 of 98

Aug 14, 2019The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.CVE-2016-10882 · WordPress plugins & themes · reported by MITREHigh 8.8
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
Product
google-document-embedder
Fixed in
2.6.2
What to do
Update google-document-embedder to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The google-document-embedder plugin before 2.6.2 for WordPress has XSS.CVE-2016-10881 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
Product
google-document-embedder
Fixed in
2.6.2
What to do
Update google-document-embedder to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The google-document-embedder plugin before 2.6.1 for WordPress has XSS.CVE-2016-10880 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
Product
google-document-embedder
Fixed in
2.6.1
What to do
Update google-document-embedder to 2.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.CVE-2015-9310 · WordPress plugins & themes · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.1
What to do
Update all-in-one-wp-security-and-firewall to 3.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.CVE-2015-9309 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.CVE-2015-9308 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.CVE-2015-9307 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.CVE-2013-7476 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
Product
simple-fields
Fixed in
1.2
What to do
Update simple-fields to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.CVE-2019-15025 · WordPress plugins & themes · reported by MITRECritical 9.8
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
Product
ninja-forms
Fixed in
3.3.21.2
What to do
Update ninja-forms to 3.3.21.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18514 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.CVE-2016-10889 · WordPress plugins & themes · reported by MITRECritical 9.8
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
Product
nextgen-gallery
Fixed in
2.1.57
What to do
Update nextgen-gallery to 2.1.57 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameterCVE-2015-9316 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Product
wp-fastest-cache
Fixed in
0.8.4.9
What to do
Update wp-fastest-cache to 0.8.4.9 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Aug 14, 2019The newstatpress plugin before 1.0.1 for WordPress has SQL injection.CVE-2015-9315 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Product
newstatpress
Fixed in
1.0.1
What to do
Update newstatpress to 1.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.CVE-2015-9314 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
Product
newstatpress
Fixed in
1.0.4
What to do
Update newstatpress to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.CVE-2015-9313 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Product
newstatpress
Fixed in
1.0.5
What to do
Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.CVE-2015-9312 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Product
newstatpress
Fixed in
1.0.5
What to do
Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.CVE-2015-9311 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
Product
newstatpress
Fixed in
1.0.6
What to do
Update newstatpress to 1.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.CVE-2017-18515 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
Product
wp-statistics
Fixed in
12.0.8
What to do
Update wp-statistics to 12.0.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.CVE-2017-18488 · WordPress plugins & themes · reported by MITREMedium 6.1
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
Product
Backup Guard
Fixed in
1.1.47
What to do
Update Backup Guard to 1.1.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.CVE-2017-18487 · WordPress plugins & themes · reported by MITREMedium 6.1
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
Product
adsense-plugin (aka Google AdSense)
Fixed in
1.44
What to do
Update adsense-plugin (aka Google AdSense) to 1.44 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.CVE-2016-10867 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.6
What to do
Update all-in-one-wp-security-and-firewall to 4.0.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.CVE-2016-10866 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.2.0
What to do
Update all-in-one-wp-security-and-firewall to 4.2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.CVE-2018-20964 · WordPress plugins & themes · reported by MITREHigh 8.8
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
Product
contact-form-to-email
Fixed in
1.2.66
What to do
Update contact-form-to-email to 1.2.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.CVE-2018-20963 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.
Product
contact-form-to-email
Fixed in
1.2.66
What to do
Update contact-form-to-email to 1.2.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.CVE-2017-18507 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
Product
wp-live-chat-support
Fixed in
7.1.05
What to do
Update wp-live-chat-support to 7.1.05 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.CVE-2017-18498 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
Product
simple-job-board
Fixed in
2.4.4
What to do
Update simple-job-board to 2.4.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The liveforms plugin before 3.4.0 for WordPress has XSS.CVE-2017-18497 · WordPress plugins & themes · reported by MITREMedium 6.1
The liveforms plugin before 3.4.0 for WordPress has XSS.
Product
liveforms
Fixed in
3.4.0
What to do
Update liveforms to 3.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.CVE-2017-18496 · WordPress plugins & themes · reported by MITREMedium 6.1
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
Product
htaccess
Fixed in
1.7.6
What to do
Update htaccess to 1.7.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.CVE-2017-18495 · WordPress plugins & themes · reported by MITREMedium 6.1
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
Product
gravity-forms-sms-notifications
Fixed in
2.4.0
What to do
Update gravity-forms-sms-notifications to 2.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.CVE-2017-18494 · WordPress plugins & themes · reported by MITREMedium 6.1
The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
Product
custom-search-plugin
Fixed in
1.36
What to do
Update custom-search-plugin to 1.36 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.CVE-2017-18493 · WordPress plugins & themes · reported by MITREMedium 6.1
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
Product
custom-admin-page
Fixed in
0.1.2
What to do
Update custom-admin-page to 0.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.CVE-2017-18492 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
Product
contact-form-to-db
Fixed in
1.5.7
What to do
Update contact-form-to-db to 1.5.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.CVE-2017-18491 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
Product
contact-form-plugin
Fixed in
4.0.6
What to do
Update contact-form-plugin to 4.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.CVE-2017-18490 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
Product
contact-form-multi
Fixed in
1.2.1
What to do
Update contact-form-multi to 1.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.CVE-2017-18489 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
Product
contact-form-7-sms-addon
Fixed in
2.4.0
What to do
Update contact-form-7-sms-addon to 2.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.CVE-2016-10871 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
Product
mailchimp-for-wp
Fixed in
4.0.11
What to do
Update mailchimp-for-wp to 4.0.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The google-language-translator plugin before 5.0.06 for WordPress has XSS.CVE-2016-10870 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-language-translator plugin before 5.0.06 for WordPress has XSS.
Product
google-language-translator
Fixed in
5.0.06
What to do
Update google-language-translator to 5.0.06 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.CVE-2016-10869 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
4.0.2
What to do
Update contact-form-plugin to 4.0.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.CVE-2016-10868 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.5
What to do
Update all-in-one-wp-security-and-firewall to 4.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The simple-fields plugin before 1.4.11 for WordPress has XSS.CVE-2015-9302 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-fields plugin before 1.4.11 for WordPress has XSS.
Product
simple-fields
Fixed in
1.4.11
What to do
Update simple-fields to 1.4.11 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The liveforms plugin before 3.2.0 for WordPress has SQL injection.CVE-2015-9301 · WordPress plugins & themes · reported by MITRECritical 9.8
The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Product
liveforms
Fixed in
3.2.0
What to do
Update liveforms to 3.2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.CVE-2015-9300 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Product
events-manager
Fixed in
5.5.7
What to do
Update events-manager to 5.5.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.CVE-2015-9299 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
Product
events-manager
Fixed in
5.5.7.1
What to do
Update events-manager to 5.5.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has code injection.CVE-2015-9298 · WordPress plugins & themes · reported by MITRECritical 9.8
The events-manager plugin before 5.6 for WordPress has code injection.
Product
events-manager
Fixed in
5.6
What to do
Update events-manager to 5.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has XSS.CVE-2015-9297 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.6 for WordPress has XSS.
Product
events-manager
Fixed in
5.6
What to do
Update events-manager to 5.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.CVE-2015-9296 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Product
download-monitor
Fixed in
1.7.1
What to do
Update download-monitor to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 3.96 for WordPress has XSS.CVE-2015-9295 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
3.96
What to do
Update contact-form-plugin to 3.96 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.CVE-2015-9294 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.5
What to do
Update all-in-one-wp-security-and-firewall to 3.9.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.CVE-2015-9293 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.8
What to do
Update all-in-one-wp-security-and-firewall to 3.9.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 3.52 for WordPress has XSS.CVE-2013-7475 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
3.52
What to do
Update contact-form-plugin to 3.52 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.