Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

541new WordPress flaws this week

391,528entries in the database

3,808 results · page 73 of 77

Aug 22, 2019The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.CVE-2013-7483 · WordPress plugins & themes · reported by MITRECritical 9.8
The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.
Product
slidedeck2
Fixed in
2.3.5
What to do
Update slidedeck2 to 2.3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.CVE-2019-15330 · WordPress plugins & themes · reported by MITREHigh 7.5
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.
Product
webp-express
Fixed in
0.14.11
What to do
Update webp-express to 0.14.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.CVE-2015-9341 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
Product
wp-file-upload
Fixed in
3.4.1
What to do
Update wp-file-upload to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-15322 · WordPress plugins & themes · reported by MITRECritical 9.8
The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.
Product
shortcode-factory
Fixed in
2.8
What to do
Update shortcode-factory to 2.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.CVE-2018-20985 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.
Product
wp-payeezy-pay
Fixed in
2.98
What to do
Update wp-payeezy-pay to 2.98 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.CVE-2015-9337 · WordPress plugins & themes · reported by MITREHigh 7.5
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Product
profile-builder
Fixed in
2.1.4
What to do
Update profile-builder to 2.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.CVE-2014-10384 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.CVE-2014-10383 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.CVE-2016-10911 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
Product
profile-builder
Fixed in
2.4.2
What to do
Update profile-builder to 2.4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The profile-builder plugin before 2.2.5 for WordPress has XSS.CVE-2015-9328 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 2.2.5 for WordPress has XSS.
Product
profile-builder
Fixed in
2.2.5
What to do
Update profile-builder to 2.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-10380 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
Product
profile-builder
Fixed in
1.1.66
What to do
Update profile-builder to 1.1.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.CVE-2019-15111 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
Product
wp-front-end-profile
Fixed in
0.2.2
What to do
Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.CVE-2019-15110 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
Product
wp-front-end-profile
Fixed in
0.2.2
What to do
Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.CVE-2016-10914 · WordPress plugins & themes · reported by MITREHigh 8.8
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
Product
add-from-server
Fixed in
3.3.2
What to do
Update add-from-server to 3.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.CVE-2018-20973 · WordPress plugins & themes · reported by MITRECritical 9.8
The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.CVE-2016-10868 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.5
What to do
Update all-in-one-wp-security-and-firewall to 4.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=CVE-2019-14798 · WordPress plugins & themes · reported by MITREMedium 4.9
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
Product
10Web Photo Gallery
Fixed in
1.5.25
What to do
Update 10Web Photo Gallery to 1.5.25 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.CVE-2019-14794 · WordPress plugins & themes · reported by MITREHigh 7.5
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.
Product
Meta Box
Fixed in
4.16.2
What to do
Update Meta Box to 4.16.2 or newer.
Full record and what to do →NVD record metabox.io metabox.io
Aug 9, 2019The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.CVE-2019-14793 · WordPress plugins & themes · reported by MITREMedium 6.5
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
Product
Meta Box
Fixed in
4.16.3
What to do
Update Meta Box to 4.16.3 or newer.
Full record and what to do →NVD record metabox.io pluginvulnerabilities.com
Jul 29, 2019The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_foCVE-2019-6726 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header.
Product
WP Fastest Cache
Affected
up to 0.8.9.0
What to do
Affects up to 0.8.9.0. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jul 21, 2019An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via tCVE-2019-14206 · WordPress plugins & themes · reported by MITREHigh 7.5
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php.
Product
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images
Fixed in
0.6.67
What to do
Update An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images to 0.6.67 or newer.
Full record and what to do →NVD record github.com markgruffer.github.io
Jul 21, 2019A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via theCVE-2019-14205 · WordPress plugins & themes · reported by MITREHigh 7.5
A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.
Product
A Local File Inclusion vulnerability in the Nevma Adaptive Images
Fixed in
0.6.67
What to do
Update A Local File Inclusion vulnerability in the Nevma Adaptive Images to 0.6.67 or newer.
Full record and what to do →NVD record github.com markgruffer.github.io
Jun 3, 2019The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.CVE-2019-11185 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
Product
WP Live Chat Support Pro
Affected
up to 8.0.26
What to do
Affects up to 8.0.26. Update WP Live Chat Support Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wp-livechat.com
May 23, 2019In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/CVE-2019-10866 · WordPress plugins & themes · reported by MITRECritical 9.8
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
Product
In the Form Maker
Fixed in
1.13.3
What to do
Update In the Form Maker to 1.13.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
May 13, 2019The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.CVE-2019-9618 · WordPress plugins & themes · reported by MITRECritical 9.8
The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
May 7, 2019The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files,CVE-2018-19456 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files, as demonstrated by download.sql.
Product
WP Backup+ (aka WPbackupplus)
Affected
up to 2018-11-22
What to do
Affects up to 2018-11-22. Update WP Backup+ (aka WPbackupplus) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.opensuse.org easyhack.in
May 7, 2019Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated).CVE-2019-10869 · WordPress plugins & themes · reported by MITREHigh 8.1
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
Product
Path Traversal and Unrestricted File Upload exists in the Ninja Forms
Fixed in
3.0.23
What to do
Update Path Traversal and Unrestricted File Upload exists in the Ninja Forms to 3.0.23 or newer.
Full record and what to do →NVD record wpscan.com wpvulndb.com
Apr 29, 2019The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion CVE-2019-11591 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form
Fixed in
1.13.5
What to do
Update WebDorado Contact Form to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 29, 2019The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via diCVE-2019-11590 · WordPress plugins & themes · reported by MITREHigh 8.8
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
10Web Form Maker
Fixed in
1.13.5
What to do
Update 10Web Form Maker to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 26, 2019The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inCVE-2019-11557 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form Builder
Fixed in
1.0.69
What to do
Update WebDorado Contact Form Builder to 1.0.69 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 18, 2019An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading CVE-2019-11223 · WordPress plugins & themes · reported by MITRECritical 9.8
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Product
An Unrestricted File Upload Vulnerability in the SupportCandy
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update An Unrestricted File Upload Vulnerability in the SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.kalasag.com.ph wordpress.org
Apr 15, 2019There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.CVE-2018-16967 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
Product
mndpsingh287 File Manager
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update mndpsingh287 File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com wordpress.org
Apr 15, 2019There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.CVE-2018-16966 · WordPress plugins & themes · reported by MITREHigh 8.8
There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
Product
mndpsingh287 File Manager
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update mndpsingh287 File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com wordpress.org
Apr 3, 2019A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsCVE-2019-10673 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.
Product
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member
Fixed in
2.0.40
What to do
Update A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Apr 1, 2019pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionCoCVE-2019-6715 · WordPress plugins & themes · reported by MITREHigh 7.5
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.
Product
pub/sns.php in the W3 Total Cache
Fixed in
0.9.4
What to do
Update pub/sns.php in the W3 Total Cache to 0.9.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com vinhjaxt.github.io
Mar 27, 2019An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27.CVE-2019-1010257 · WordPress plugins & themes · reported by josh@bress.netCritical 9.1
An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can be downloaded. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.
Product
article2pdf
Fixed in
5.3
What to do
Update article2pdf to 5.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 27, 2019A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27.CVE-2019-1000031 · WordPress plugins & themes · reported by josh@bress.netHigh 7.5
A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visiting PDF generation link but not following the redirect will leave behind a PDF file on disk which will never be deleted by the plug-in.
Product
article2pdf
Affected
0.24 to 0.27
What to do
Affects 0.24 to 0.27. Update article2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, whicCVE-2018-19488 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account.
Product
WP-jobhunt
Fixed in
2.4
What to do
Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.phpCVE-2018-19487 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.
Product
WP-jobhunt
Fixed in
2.4
What to do
Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 19, 2019WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, sucCVE-2019-8942 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com rapid7.com
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating fCVE-2015-4617 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.
Affected
1.09 to 1.09
What to do
Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the diCVE-2018-19043 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mreloCVE-2018-19042 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.CVE-2018-19041 · WordPress plugins & themes · reported by MITREMedium 6.1
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to CVE-2018-19040 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 15, 2019logging system of the Automattic WooCommerce plugin before 3.4.6: A File Deletion vulnerabilityCVE-2018-20714 · WordPress plugins & themes · reported by MITREHigh 8.1
The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate privileges to admin.
Product
logging system of the Automattic WooCommerce plugin before 3.4.6
Fixed in
3.4.6
What to do
Update logging system of the Automattic WooCommerce plugin before 3.4.6 to 3.4.6 or newer.
Full record and what to do →NVD record blog.ripstech.com blog.ripstech.com
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictiCVE-2018-20149 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.CVE-2018-20147 · WordPress plugins & themes · reported by MITREMedium 6.5
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Nov 28, 2018A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allowsCVE-2018-19370 · WordPress plugins & themes · reported by MITREMedium 6.6
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
Product
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo)
Fixed in
9.2.0
What to do
Update A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) to 9.2.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Oct 17, 2018In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the ChatCVE-2018-18373 · WordPress plugins & themes · reported by MITREMedium 5.4
In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sb_ajax_add_message action.
Product
Schiocco "Support Board - Chat And Help Desk
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update Schiocco "Support Board - Chat And Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.