Updated 14 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

3,906 results · page 76 of 79

Aug 22, 2019The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-18574 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
Product
ninja-forms
Fixed in
3.0.31
What to do
Update ninja-forms to 3.0.31 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.CVE-2017-18570 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
Product
cforms2
Fixed in
14.13
What to do
Update cforms2 to 14.13 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 14.6.10 for WordPress has SQL injection.CVE-2015-9333 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
Product
cforms2
Fixed in
14.6.10
What to do
Update cforms2 to 14.6.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.CVE-2013-7481 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
3.3.5
What to do
Update contact-form-plugin to 3.3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.CVE-2013-7480 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
Product
events-manager
Fixed in
5.3.6.1
What to do
Update events-manager to 5.3.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.CVE-2013-7479 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
Product
events-manager
Fixed in
5.3.9
What to do
Update events-manager to 5.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.CVE-2013-7477 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
Product
events-manager
Fixed in
5.5.2
What to do
Update events-manager to 5.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.CVE-2017-18559 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
Product
cforms2
Fixed in
14.13.3
What to do
Update cforms2 to 14.13.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.CVE-2014-10377 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
Product
cforms2
Fixed in
13.2
What to do
Update cforms2 to 13.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.CVE-2016-10910 · WordPress plugins & themes · reported by MITREMedium 6.1
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
Product
formbuilder
Fixed in
1.06
What to do
Update formbuilder to 1.06 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-10380 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
Product
profile-builder
Fixed in
1.1.66
What to do
Update profile-builder to 1.1.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.CVE-2012-6715 · WordPress plugins & themes · reported by MITREMedium 6.1
The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.
Product
formbuilder
Fixed in
0.9.1
What to do
Update formbuilder to 0.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.CVE-2016-10909 · WordPress plugins & themes · reported by MITRECritical 9.8
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.CVE-2016-10908 · WordPress plugins & themes · reported by MITREMedium 6.1
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.CVE-2016-10903 · WordPress plugins & themes · reported by MITREHigh 8.8
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
Product
GoDaddy godaddy-email-marketing-sign-up-forms
Fixed in
1.1.3
What to do
Update GoDaddy godaddy-email-marketing-sign-up-forms to 1.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.CVE-2015-9319 · WordPress plugins & themes · reported by MITREMedium 6.1
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Product
gregs-high-performance-seo
Fixed in
1.6.2
What to do
Update gregs-high-performance-seo to 1.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-15238 · WordPress plugins & themes · reported by MITREHigh 8.8
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
Product
cforms2
Fixed in
15.0.2
What to do
Update cforms2 to 15.0.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.CVE-2015-9317 · WordPress plugins & themes · reported by MITREMedium 6.1
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
Product
awesome-support
Fixed in
3.1.7
What to do
Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.CVE-2019-15114 · WordPress plugins & themes · reported by MITREHigh 8.8
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
Product
formcraft-form-builder
Fixed in
1.2.2
What to do
Update formcraft-form-builder to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.CVE-2017-18547 · WordPress plugins & themes · reported by MITREHigh 8.8
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
Product
nelio-ab-testing
Fixed in
4.6.4
What to do
Update nelio-ab-testing to 4.6.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.CVE-2019-14784 · WordPress plugins & themes · reported by MITREMedium 6.1
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
Product
CP Contact Form with PayPal
Fixed in
1.2.98
What to do
Update CP Contact Form with PayPal to 1.2.98 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-pCVE-2019-14800 · WordPress plugins & themes · reported by MITREMedium 5.3
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.
Product
FV Flowplayer Video Player
Fixed in
7.3.15.727
What to do
Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 14, 2019The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.CVE-2019-15025 · WordPress plugins & themes · reported by MITRECritical 9.8
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
Product
ninja-forms
Fixed in
3.3.21.2
What to do
Update ninja-forms to 3.3.21.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.CVE-2018-20964 · WordPress plugins & themes · reported by MITREHigh 8.8
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
Product
contact-form-to-email
Fixed in
1.2.66
What to do
Update contact-form-to-email to 1.2.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.CVE-2018-20963 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.
Product
contact-form-to-email
Fixed in
1.2.66
What to do
Update contact-form-to-email to 1.2.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The liveforms plugin before 3.4.0 for WordPress has XSS.CVE-2017-18497 · WordPress plugins & themes · reported by MITREMedium 6.1
The liveforms plugin before 3.4.0 for WordPress has XSS.
Product
liveforms
Fixed in
3.4.0
What to do
Update liveforms to 3.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.CVE-2017-18495 · WordPress plugins & themes · reported by MITREMedium 6.1
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
Product
gravity-forms-sms-notifications
Fixed in
2.4.0
What to do
Update gravity-forms-sms-notifications to 2.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.CVE-2017-18492 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
Product
contact-form-to-db
Fixed in
1.5.7
What to do
Update contact-form-to-db to 1.5.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.CVE-2017-18491 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
Product
contact-form-plugin
Fixed in
4.0.6
What to do
Update contact-form-plugin to 4.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.CVE-2017-18490 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
Product
contact-form-multi
Fixed in
1.2.1
What to do
Update contact-form-multi to 1.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.CVE-2017-18489 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
Product
contact-form-7-sms-addon
Fixed in
2.4.0
What to do
Update contact-form-7-sms-addon to 2.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.CVE-2016-10869 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
4.0.2
What to do
Update contact-form-plugin to 4.0.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The liveforms plugin before 3.2.0 for WordPress has SQL injection.CVE-2015-9301 · WordPress plugins & themes · reported by MITRECritical 9.8
The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Product
liveforms
Fixed in
3.2.0
What to do
Update liveforms to 3.2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 3.96 for WordPress has XSS.CVE-2015-9295 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
3.96
What to do
Update contact-form-plugin to 3.96 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The contact-form-plugin plugin before 3.52 for WordPress has XSS.CVE-2013-7475 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
3.52
What to do
Update contact-form-plugin to 3.52 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.CVE-2016-10872 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
Product
ultimate-member
Fixed in
1.3.40
What to do
Update ultimate-member to 1.3.40 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.phpCVE-2019-14785 · WordPress plugins & themes · reported by MITREMedium 5.4
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
Product
CP Contact Form with PayPal
Fixed in
1.2.99
What to do
Update CP Contact Form with PayPal to 1.2.99 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 5, 2019The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?actioCVE-2019-14348 · WordPress plugins & themes · reported by MITRECritical 9.8
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter.
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
Jul 30, 2019A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.CVE-2019-14327 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
Product
Custom Simple Rss
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Custom Simple Rss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 18, 2019A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9.CVE-2019-13575 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
May 23, 2019In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/CVE-2019-10866 · WordPress plugins & themes · reported by MITRECritical 9.8
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
Product
In the Form Maker
Fixed in
1.13.3
What to do
Update In the Form Maker to 1.13.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
May 22, 2019WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/eCVE-2017-6514 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com github.com
May 7, 2019The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files,CVE-2018-19456 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files, as demonstrated by download.sql.
Product
WP Backup+ (aka WPbackupplus)
Affected
up to 2018-11-22
What to do
Affects up to 2018-11-22. Update WP Backup+ (aka WPbackupplus) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.opensuse.org easyhack.in
May 7, 2019Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated).CVE-2019-10869 · WordPress plugins & themes · reported by MITREHigh 8.1
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
Product
Path Traversal and Unrestricted File Upload exists in the Ninja Forms
Fixed in
3.0.23
What to do
Update Path Traversal and Unrestricted File Upload exists in the Ninja Forms to 3.0.23 or newer.
Full record and what to do →NVD record wpscan.com wpvulndb.com
Apr 29, 2019The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion CVE-2019-11591 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form
Fixed in
1.13.5
What to do
Update WebDorado Contact Form to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 29, 2019The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via diCVE-2019-11590 · WordPress plugins & themes · reported by MITREHigh 8.8
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
10Web Form Maker
Fixed in
1.13.5
What to do
Update 10Web Form Maker to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 26, 2019The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inCVE-2019-11557 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form Builder
Fixed in
1.0.69
What to do
Update WebDorado Contact Form Builder to 1.0.69 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 3, 2019A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsCVE-2019-10673 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.
Product
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member
Fixed in
2.0.40
What to do
Update A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Mar 27, 2019An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27.CVE-2019-1010257 · WordPress plugins & themes · reported by josh@bress.netCritical 9.1
An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can be downloaded. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.
Product
article2pdf
Fixed in
5.3
What to do
Update article2pdf to 5.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 21, 2019The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.CVE-2019-9909 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.
Product
Donation Plugin and Fundraising Platform
Fixed in
2.3.1
What to do
Update Donation Plugin and Fundraising Platform to 2.3.1 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.