Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

5,867 results · page 77 of 118

Sep 25, 2019The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admiCVE-2015-9424 · WordPress plugins & themes · reported by MITREMedium 6.5
The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
Product
multicons
Fixed in
3.0
What to do
Update multicons to 3.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGCVE-2015-9423 · WordPress plugins & themes · reported by MITREMedium 5.4
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters.
Product
PlugNedit Adaptive Editor
Fixed in
6.2.0
What to do
Update PlugNedit Adaptive Editor to 6.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_diaCVE-2015-9422 · WordPress plugins & themes · reported by MITREMedium 6.5
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters.
Product
PlugNedit Adaptive Editor
Fixed in
6.2.0
What to do
Update PlugNedit Adaptive Editor to 6.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.CVE-2015-9421 · WordPress plugins & themes · reported by MITREMedium 6.5
The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
Product
olevmedia-shortcodes
Fixed in
1.1.9
What to do
Update olevmedia-shortcodes to 1.1.9 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.CVE-2015-9420 · WordPress plugins & themes · reported by MITREMedium 6.1
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
Product
soundcloud-is-gold
Fixed in
2.3.2
What to do
Update soundcloud-is-gold to 2.3.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.CVE-2015-9419 · WordPress plugins & themes · reported by MITREMedium 6.1
The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.
Affected
1.0.6 to 1.0.6
What to do
Affects 1.0.6 to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.CVE-2015-9418 · WordPress plugins & themes · reported by MITREMedium 4.3
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.
Product
Watu Pro
Fixed in
4.9.0.8
What to do
Update Watu Pro to 4.9.0.8 or newer.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 25, 2019The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.CVE-2015-9417 · WordPress plugins & themes · reported by MITREMedium 6.5
The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.
Product
testimonial-slider
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update testimonial-slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.CVE-2015-9416 · WordPress plugins & themes · reported by MITREMedium 6.1
The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.
Affected
2.9.3 to 3.2.6
What to do
Affects 2.9.3 to 3.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.CVE-2015-9415 · WordPress plugins & themes · reported by MITREHigh 7.5
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.
Product
bj-lazy-load
Fixed in
1.0
What to do
Update bj-lazy-load to 1.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.CVE-2015-9414 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
Product
wp-symposium
Affected
up to 15.8.1
What to do
Affects up to 15.8.1. Update wp-symposium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.CVE-2015-9413 · WordPress plugins & themes · reported by MITREMedium 6.5
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Product
eshop
Affected
up to 6.3.13
What to do
Affects up to 6.3.13. Update eshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.CVE-2015-9412 · WordPress plugins & themes · reported by MITREMedium 6.1
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.
Product
Royal-Slider
Fixed in
3.2.7
What to do
Update Royal-Slider to 3.2.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The Postmatic plugin before 1.4.6 for WordPress has XSS.CVE-2015-9411 · WordPress plugins & themes · reported by MITREMedium 6.1
The Postmatic plugin before 1.4.6 for WordPress has XSS.
Product
Postmatic
Fixed in
1.4.6
What to do
Update Postmatic to 1.4.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.CVE-2015-9410 · WordPress plugins & themes · reported by MITREMedium 5.4
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.
Affected
6.0.4 to 6.0.4
What to do
Affects 6.0.4 to 6.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com github.com
Sep 25, 2019The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.CVE-2015-9409 · WordPress plugins & themes · reported by MITREMedium 6.5
The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.
Product
alo-easymail
Fixed in
2.6.01
What to do
Update alo-easymail to 2.6.01 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a ..CVE-2015-9406 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.
Product
Directory traversal vulnerability in the mTheme-Unus
Fixed in
2.3
What to do
Update Directory traversal vulnerability in the mTheme-Unus to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 20, 2019The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.CVE-2014-10397 · WordPress plugins & themes · reported by MITREHigh 7.5
The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.
Product
Antioch
Affected
up to 2014-09-07
What to do
Affects up to 2014-09-07. Update Antioch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 20, 2019The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.CVE-2014-10396 · WordPress plugins & themes · reported by MITREHigh 7.5
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.
Product
epic
Affected
up to 2014-09-07
What to do
Affects up to 2014-09-07. Update epic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 20, 2019The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.CVE-2015-9408 · WordPress plugins & themes · reported by MITREMedium 6.5
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
Product
xpinner-lite
Affected
up to 2.2
What to do
Affects up to 2.2. Update xpinner-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.CVE-2015-9407 · WordPress plugins & themes · reported by MITREMedium 6.1
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
Product
xpinner-lite
Affected
up to 2.2
What to do
Affects up to 2.2. Update xpinner-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The wp-piwik plugin before 1.0.5 for WordPress has XSS.CVE-2015-9405 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-piwik plugin before 1.0.5 for WordPress has XSS.
Product
wp-piwik
Fixed in
1.0.5
What to do
Update wp-piwik to 1.0.5 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 20, 2019The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.CVE-2015-9404 · WordPress plugins & themes · reported by MITREMedium 6.1
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.CVE-2015-9403 · WordPress plugins & themes · reported by MITREMedium 6.1
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.CVE-2015-9402 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
Product
users-ultra
Fixed in
1.5.59
What to do
Update users-ultra to 1.5.59 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.CVE-2015-9401 · WordPress plugins & themes · reported by MITREMedium 4.8
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
Product
websimon-tables
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update websimon-tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.CVE-2015-9400 · WordPress plugins & themes · reported by MITREHigh 8.8
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
Product
wordpress-meta-robots
Affected
up to 2.1
What to do
Affects up to 2.1. Update wordpress-meta-robots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.CVE-2015-9399 · WordPress plugins & themes · reported by MITREHigh 7.2
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
Product
wp-stats-dashboard
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update wp-stats-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.CVE-2015-9398 · WordPress plugins & themes · reported by MITREHigh 8.8
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
Product
gocodes
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update gocodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.CVE-2015-9397 · WordPress plugins & themes · reported by MITREMedium 5.4
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Product
gocodes
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update gocodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.CVE-2015-9396 · WordPress plugins & themes · reported by MITREMedium 6.1
The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.
Product
auto-thickbox-plus
Affected
up to 1.9
What to do
Affects up to 1.9. Update auto-thickbox-plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.CVE-2015-9395 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
Product
users-ultra
Fixed in
1.5.64
What to do
Update users-ultra to 1.5.64 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.CVE-2015-9394 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.CVE-2015-9393 · WordPress plugins & themes · reported by MITREMedium 5.4
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.CVE-2015-9392 · WordPress plugins & themes · reported by MITREMedium 5.4
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.CVE-2016-11013 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.
Product
wp-listings
Fixed in
2.0.2
What to do
Update wp-listings to 2.0.2 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 20, 2019The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.CVE-2016-11012 · WordPress plugins & themes · reported by MITREMedium 5.4
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
Product
sola-support-tickets
Fixed in
3.13
What to do
Update sola-support-tickets to 3.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.CVE-2016-11011 · WordPress plugins & themes · reported by MITREMedium 6.5
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.CVE-2016-11010 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.CVE-2016-11009 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.CVE-2016-11008 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.CVE-2016-11007 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.CVE-2016-11006 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.CVE-2016-11005 · WordPress plugins & themes · reported by MITREMedium 6.1
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
Product
instalinker
Fixed in
1.1.2
What to do
Update instalinker to 1.1.2 or newer.
Full record and what to do →NVD record rastating.github.io wordpress.org
Sep 20, 2019The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.CVE-2016-11004 · WordPress plugins & themes · reported by MITREHigh 8.8
The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.
Product
Elegant Themes Monarch
Fixed in
1.2.7
What to do
Update Elegant Themes Monarch to 1.2.7 or newer.
Full record and what to do →NVD record pritect.net wptavern.com
Sep 20, 2019The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.CVE-2016-11003 · WordPress plugins & themes · reported by MITREHigh 8.8
The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.
Product
Elegant Themes Bloom
Fixed in
1.1.1
What to do
Update Elegant Themes Bloom to 1.1.1 or newer.
Full record and what to do →NVD record pritect.net wptavern.com
Sep 20, 2019The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.CVE-2016-11002 · WordPress plugins & themes · reported by MITREHigh 8.8
The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.
Product
Elegant Themes Extra
Fixed in
1.2.4
What to do
Update Elegant Themes Extra to 1.2.4 or newer.
Full record and what to do →NVD record pritect.net wptavern.com
Sep 20, 2019The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.CVE-2016-11001 · WordPress plugins & themes · reported by MITREMedium 6.1
The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.
Product
user-submitted-posts
Fixed in
20160215
What to do
Update user-submitted-posts to 20160215 or newer.
Full record and what to do →NVD record wordpress.org securityfocus.com
Sep 20, 2019The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.CVE-2016-11000 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.
Product
wp-ultimate-exporter
Affected
up to 1.1
What to do
Affects up to 1.1. Update wp-ultimate-exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.CVE-2016-10999 · WordPress plugins & themes · reported by MITREMedium 6.1
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
Product
Goodnews
Affected
up to 2016-02-28
What to do
Affects up to 2016-02-28. Update Goodnews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.