Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

5,867 results · page 76 of 118

Oct 10, 2019The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.CVE-2015-9459 · WordPress plugins & themes · reported by MITREMedium 6.1
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
Product
searchterms-tagging-2
Affected
up to 1.535
What to do
Affects up to 1.535. Update searchterms-tagging-2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 10, 2019The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF.CVE-2015-9458 · WordPress plugins & themes · reported by MITREHigh 7.2
The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF.
Product
searchterms-tagging-2
Affected
up to 1.535
What to do
Affects up to 1.535. Update searchterms-tagging-2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 10, 2019The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.CVE-2015-9457 · WordPress plugins & themes · reported by MITREHigh 7.2
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.
Product
pretty-link
Fixed in
1.6.8
What to do
Update pretty-link to 1.6.8 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 10, 2019The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.CVE-2019-17072 · WordPress plugins & themes · reported by MITRECritical 9.8
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
Affected
1.0.9 to 1.0.9
What to do
Affects 1.0.9 to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordpress.org
Oct 10, 2019The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.CVE-2019-17071 · WordPress plugins & themes · reported by MITREMedium 6.1
The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.
Affected
2.1.4 to 2.1.4
What to do
Affects 2.1.4 to 2.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordpress.org
Oct 10, 2019The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.CVE-2019-17070 · WordPress plugins & themes · reported by MITREMedium 6.1
The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.
Product
liquid-speech-balloon (aka LIQUID SPEECH BALLOON)
Fixed in
1.0.7
What to do
Update liquid-speech-balloon (aka LIQUID SPEECH BALLOON) to 1.0.7 or newer.
Full record and what to do →NVD record gist.github.com wordpress.org
Oct 9, 2019The animate-it plugin before 2.3.5 for WordPress has XSS.CVE-2019-17385 · WordPress plugins & themes · reported by MITREMedium 6.1
The animate-it plugin before 2.3.5 for WordPress has XSS.
Product
animate-it
Fixed in
2.3.5
What to do
Update animate-it to 2.3.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 9, 2019The animate-it plugin before 2.3.4 for WordPress has XSS.CVE-2019-17384 · WordPress plugins & themes · reported by MITREMedium 6.1
The animate-it plugin before 2.3.4 for WordPress has XSS.
Product
animate-it
Fixed in
2.3.4
What to do
Update animate-it to 2.3.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 7, 2019Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.CVE-2019-17233 · WordPress plugins & themes · reported by MITREMedium 6.1
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
Product
Functions/EWD_UFAQ_Import.php in the ultimate-faqs
Affected
up to 1.8.24
What to do
Affects up to 1.8.24. Update Functions/EWD_UFAQ_Import.php in the ultimate-faqs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Oct 7, 2019Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.CVE-2019-17232 · WordPress plugins & themes · reported by MITREHigh 7.5
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
Product
Functions/EWD_UFAQ_Import.php in the ultimate-faqs
Affected
up to 1.8.24
What to do
Affects up to 1.8.24. Update Functions/EWD_UFAQ_Import.php in the ultimate-faqs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Oct 7, 2019includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated storCVE-2019-17239 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
Product
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 7, 2019The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbCVE-2015-9456 · WordPress plugins & themes · reported by MITREMedium 6.5
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.
Product
orbisius-child-theme-creator
Fixed in
1.2.8
What to do
Update orbisius-child-theme-creator to 1.2.8 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parametCVE-2015-9455 · WordPress plugins & themes · reported by MITREHigh 8.1
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
Product
buddypress-activity-plus
Fixed in
1.6.2
What to do
Update buddypress-activity-plus to 1.6.2 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Oct 7, 2019The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.CVE-2015-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
Product
smooth-slider
Fixed in
2.7
What to do
Update smooth-slider to 2.7 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.CVE-2015-9453 · WordPress plugins & themes · reported by MITREMedium 6.1
The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
Product
broken-link-manager
Fixed in
0.6.0
What to do
Update broken-link-manager to 0.6.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.CVE-2015-9452 · WordPress plugins & themes · reported by MITRECritical 9.8
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
Product
nex-forms-express-wp-form-builder
Fixed in
4.6.1
What to do
Update nex-forms-express-wp-form-builder to 4.6.1 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameCVE-2015-9451 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.CVE-2015-9450 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.CVE-2018-18379 · WordPress plugins & themes · reported by MITREMedium 6.1
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.
Product
elementor-edit-template class in wp-admin/customize.php in the Elementor Pro
Fixed in
2.0.10
What to do
Update elementor-edit-template class in wp-admin/customize.php in the Elementor Pro to 2.0.10 or newer.
Full record and what to do →NVD record elementor.com contextis.com
Oct 6, 2019The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI.CVE-2019-17214 · WordPress plugins & themes · reported by MITREHigh 7.5
The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI.
Affected
1.3.0 to 1.3.0
What to do
Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 6, 2019The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.CVE-2019-17213 · WordPress plugins & themes · reported by MITREMedium 6.1
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
Affected
1.3.0 to 1.3.0
What to do
Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com acunetix.com
Oct 3, 2019A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or otheCVE-2019-16931 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
Product
Visualizer
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Visualizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record nathandavison.com wordpress.org
Sep 30, 2019A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.CVE-2019-16932 · WordPress plugins & themes · reported by MITRECritical 10
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.
Product
A blind SSRF vulnerability exists in the Visualizer
Fixed in
3.3.1
What to do
Update A blind SSRF vulnerability exists in the Visualizer to 3.3.1 or newer.
Full record and what to do →NVD record nathandavison.com wordpress.org
Sep 27, 2019In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full paCVE-2019-16902 · WordPress plugins & themes · reported by MITREHigh 7.5
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.
Product
ARforms
Affected
3.7.1 to 3.7.1
What to do
Affects 3.7.1 to 3.7.1. Update ARforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record almorabea.net arformsplugin.com
Sep 26, 2019The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to impCVE-2019-16524 · WordPress plugins & themes · reported by MITREMedium 4.8
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.
Product
easy-fancybox
Fixed in
1.8.18
What to do
Update easy-fancybox to 1.8.18 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 26, 2019The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.CVE-2015-9448 · WordPress plugins & themes · reported by MITREHigh 8.8
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.
Product
sendpress
Fixed in
1.2
What to do
Update sendpress to 1.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.CVE-2015-9447 · WordPress plugins & themes · reported by MITREMedium 6.5
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.CVE-2015-9446 · WordPress plugins & themes · reported by MITREHigh 8.8
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.CVE-2015-9445 · WordPress plugins & themes · reported by MITREHigh 8.8
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.CVE-2015-9444 · WordPress plugins & themes · reported by MITREMedium 6.1
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
Affected
1.3.0 to 1.3.0
What to do
Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.CVE-2015-9443 · WordPress plugins & themes · reported by MITREMedium 6.5
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.CVE-2015-9442 · WordPress plugins & themes · reported by MITREMedium 6.5
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.CVE-2015-9441 · WordPress plugins & themes · reported by MITREMedium 6.5
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
Affected
2.9.2 to 2.9.2
What to do
Affects 2.9.2 to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.CVE-2015-9440 · WordPress plugins & themes · reported by MITREMedium 6.5
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
Product
monetize
Affected
up to 1.03
What to do
Affects up to 1.03. Update monetize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.CVE-2015-9439 · WordPress plugins & themes · reported by MITREMedium 4.8
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
Product
addthis
Fixed in
5.0.13
What to do
Update addthis to 5.0.13 or newer.
Full record and what to do →NVD record blog.cinu.pl wordpress.org
Sep 25, 2019The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameterCVE-2015-9438 · WordPress plugins & themes · reported by MITREMedium 5.4
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Product
display-widgets
Fixed in
2.04
What to do
Update display-widgets to 2.04 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.CVE-2015-9437 · WordPress plugins & themes · reported by MITREMedium 6.5
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Product
dynamic-widgets
Fixed in
1.5.11
What to do
Update dynamic-widgets to 1.5.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.CVE-2015-9436 · WordPress plugins & themes · reported by MITREMedium 5.4
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.
Product
dynamic-widgets
Fixed in
1.5.11
What to do
Update dynamic-widgets to 1.5.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.CVE-2015-9435 · WordPress plugins & themes · reported by MITRECritical 9.8
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
Product
oauth2-provider
Fixed in
3.1.5
What to do
Update oauth2-provider to 3.1.5 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Sep 25, 2019The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or taCVE-2015-9434 · WordPress plugins & themes · reported by MITREMedium 6.5
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Product
kiwi-logo-carousel
Fixed in
1.7.2
What to do
Update kiwi-logo-carousel to 1.7.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc.CVE-2015-9433 · WordPress plugins & themes · reported by MITREMedium 6.5
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php.
Product
wp-social-bookmarking-light
Fixed in
1.7.10
What to do
Update wp-social-bookmarking-light to 1.7.10 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-CVE-2015-9432 · WordPress plugins & themes · reported by MITREMedium 6.5
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Product
alpine-photo-tile-for-instagram
Fixed in
1.2.7.6
What to do
Update alpine-photo-tile-for-instagram to 1.2.7.6 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_CVE-2015-9431 · WordPress plugins & themes · reported by MITREMedium 6.5
The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.
Product
qtranslate-x
Fixed in
3.4.4
What to do
Update qtranslate-x to 3.4.4 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.CVE-2015-9449 · WordPress plugins & themes · reported by MITREHigh 7.2
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Product
microblog-poster
Fixed in
1.6.2
What to do
Update microblog-poster to 1.6.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.CVE-2015-9430 · WordPress plugins & themes · reported by MITREMedium 6.1
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.
Product
crazy-bone
Fixed in
0.6.0
What to do
Update crazy-bone to 0.6.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameCVE-2015-9429 · WordPress plugins & themes · reported by MITREMedium 6.5
The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
Product
yith-maintenance-mode
Fixed in
1.2.0
What to do
Update yith-maintenance-mode to 1.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone,CVE-2015-9428 · WordPress plugins & themes · reported by MITREMedium 6.5
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.
Product
wplegalpages
Fixed in
1.1
What to do
Update wplegalpages to 1.1 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.CVE-2015-9427 · WordPress plugins & themes · reported by MITREMedium 6.5
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
Product
googmonify
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update googmonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.CVE-2015-9426 · WordPress plugins & themes · reported by MITREMedium 4.6
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
Product
manual-image-crop
Fixed in
1.11
What to do
Update manual-image-crop to 1.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallockeCVE-2015-9425 · WordPress plugins & themes · reported by MITREMedium 5.4
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.
Product
social-locker
Fixed in
4.2.5
What to do
Update social-locker to 4.2.5 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.