Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

5,867 results · page 79 of 118

Sep 16, 2019The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.CVE-2016-10957 · WordPress plugins & themes · reported by MITREMedium 6.1
The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
Product
Akal
Affected
up to 2016-08-22
What to do
Affects up to 2016-08-22. Update Akal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com saotn.org
Sep 16, 2019The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.CVE-2017-18634 · WordPress plugins & themes · reported by MITRECritical 9.8
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.
Product
newspaper
Fixed in
6.7.2
What to do
Update newspaper to 6.7.2 or newer.
Full record and what to do →NVD record blog.sucuri.net blog.sucuri.net
Sep 16, 2019The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.CVE-2016-10956 · WordPress plugins & themes · reported by MITREHigh 7.5
The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cxsecurity.com wordpress.org
Sep 15, 2019In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possiCVE-2019-16332 · WordPress plugins & themes · reported by MITREMedium 6.1
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
Product
api-bearer-auth
Fixed in
20190907
What to do
Update api-bearer-auth to 20190907 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 13, 2019The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.CVE-2019-16289 · WordPress plugins & themes · reported by MITREMedium 5.4
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
Product
insert-php (aka Woody ad snippets)
Fixed in
2.2.8
What to do
Update insert-php (aka Woody ad snippets) to 2.2.8 or newer.
Full record and what to do →NVD record generaleg0x01.com wordpress.org
Sep 13, 2019An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress.CVE-2019-12517 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress backend for all users with at least Subscriber rights. Because the plugin does not properly validate and sanitize this data, a malicious payload in either the name or email field is executed directly within the backend at /wp-admin/admin.php?page=slickquiz across all users with the privileges of at least Subscriber.
Product
An XSS issue was discovered in the slickquiz
Affected
up to 1.3.7.1
What to do
Affects up to 1.3.7.1. Update An XSS issue was discovered in the slickquiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 13, 2019The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= CVE-2019-12516 · WordPress plugins & themes · reported by MITREHigh 8.8
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI.
Product
slickquiz
Affected
up to 1.3.7.1
What to do
Affects up to 1.3.7.1. Update slickquiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 13, 2019The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.CVE-2016-10955 · WordPress plugins & themes · reported by MITRECritical 9.8
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
Product
cysteme-finder
Fixed in
1.4
What to do
Update cysteme-finder to 1.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 13, 2019The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.CVE-2016-10954 · WordPress plugins & themes · reported by MITRECritical 9.8
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
Product
Neosense
Fixed in
1.8
What to do
Update Neosense to 1.8 or newer.
Full record and what to do →NVD record lifeforms.nl wpvulndb.com
Sep 13, 2019The Headway theme before 3.8.9 for WordPress has XSS via the license key field.CVE-2016-10953 · WordPress plugins & themes · reported by MITREMedium 5.4
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
Product
Headway
Fixed in
3.8.9
What to do
Update Headway to 3.8.9 or newer.
Full record and what to do →NVD record wptavern.com wpvulndb.com
Sep 13, 2019The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.CVE-2016-10952 · WordPress plugins & themes · reported by MITREMedium 6.1
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.
Product
quotes-collection
Fixed in
2.0.6
What to do
Update quotes-collection to 2.0.6 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 13, 2019The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.CVE-2016-10951 · WordPress plugins & themes · reported by MITREHigh 7.2
The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
Affected
2.07.02 to 2.07.02
What to do
Affects 2.07.02 to 2.07.02. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 13, 2019The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.CVE-2016-10950 · WordPress plugins & themes · reported by MITREHigh 8.8
The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.
Product
sirv
Fixed in
1.3.2
What to do
Update sirv to 1.3.2 or newer.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 13, 2019The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.CVE-2016-10949 · WordPress plugins & themes · reported by MITREHigh 8.8
The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.
Product
Relevanssi Premium
Fixed in
1.14.6.1
What to do
Update Relevanssi Premium to 1.14.6.1 or newer.
Full record and what to do →NVD record advisories.dxw.com advisories.dxw.com
Sep 13, 2019The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.CVE-2016-10948 · WordPress plugins & themes · reported by MITREHigh 8.1
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.
Product
Post Indexer
Fixed in
3.0.6.2
What to do
Update Post Indexer to 3.0.6.2 or newer.
Full record and what to do →NVD record advisories.dxw.com advisories.dxw.com
Sep 13, 2019The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.CVE-2016-10947 · WordPress plugins & themes · reported by MITREHigh 7.2
The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
Product
Post Indexer
Fixed in
3.0.6.2
What to do
Update Post Indexer to 3.0.6.2 or newer.
Full record and what to do →NVD record advisories.dxw.com advisories.dxw.com
Sep 13, 2019The wp-d3 plugin before 2.4.1 for WordPress has CSRF.CVE-2016-10946 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
Product
wp-d3
Fixed in
2.4.1
What to do
Update wp-d3 to 2.4.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 13, 2019The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.CVE-2017-18615 · WordPress plugins & themes · reported by MITREMedium 6.1
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
Product
kama-clic-counter
Fixed in
3.5.0
What to do
Update kama-clic-counter to 3.5.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Sep 13, 2019The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.CVE-2017-18614 · WordPress plugins & themes · reported by MITREHigh 8.1
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
Affected
up to 3.4.9
What to do
Affects up to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 13, 2019The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.CVE-2017-18613 · WordPress plugins & themes · reported by MITREMedium 6.1
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 13, 2019The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.CVE-2017-18612 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record rastating.github.io wordpress.org
Sep 13, 2019The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.CVE-2016-10945 · WordPress plugins & themes · reported by MITREHigh 8.8
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record klikki.fi wpvulndb.com
Sep 13, 2019The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.CVE-2016-10944 · WordPress plugins & themes · reported by MITREHigh 8.8
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
Product
multisite-post-duplicator
Fixed in
1.1.3
What to do
Update multisite-post-duplicator to 1.1.3 or newer.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 13, 2019The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.CVE-2016-10943 · WordPress plugins & themes · reported by MITREHigh 7.2
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 13, 2019The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.CVE-2016-10942 · WordPress plugins & themes · reported by MITRECritical 9.8
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
Product
podlove-podcasting-plugin-for-wordpress
Fixed in
2.3.16
What to do
Update podlove-podcasting-plugin-for-wordpress to 2.3.16 or newer.
Full record and what to do →NVD record blog.ripstech.com github.com
Sep 13, 2019The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.CVE-2016-10941 · WordPress plugins & themes · reported by MITREMedium 6.1
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
Product
podlove-podcasting-plugin-for-wordpress
Fixed in
2.3.16
What to do
Update podlove-podcasting-plugin-for-wordpress to 2.3.16 or newer.
Full record and what to do →NVD record blog.ripstech.com github.com
Sep 13, 2019The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.CVE-2016-10940 · WordPress plugins & themes · reported by MITREHigh 7.2
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 13, 2019The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.CVE-2016-10939 · WordPress plugins & themes · reported by MITREHigh 7.2
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 13, 2019The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.CVE-2016-10938 · WordPress plugins & themes · reported by MITREMedium 6.5
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 12, 2019WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier: Cross-site request forgery (CSRF)CVE-2019-5992 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier
Affected
up to 4.4
What to do
Affects up to 4.4. Update WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp jvn.jp
Sep 11, 2019includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style SheetCVE-2019-16250 · WordPress plugins & themes · reported by MITREHigh 7.5
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.
Product
includes/wizard/wizard.php in the Ocean Extra
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update includes/wizard/wizard.php in the Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Sep 11, 2019Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).CVE-2019-14936 · WordPress plugins & themes · reported by MITREMedium 5.3
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).
Affected
1.3.2 to 1.3.2
What to do
Affects 1.3.2 to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blackdragon.team blackdragon.team
Sep 11, 2019WordPress before 5.2.3 allows XSS in post previews by authenticated users.CVE-2019-16223 · WordPress plugins & themes · reported by MITREMedium 5.4
WordPress before 5.2.3 allows XSS in post previews by authenticated users.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com lists.debian.org
Sep 11, 2019WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacCVE-2019-16222 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org github.com
Sep 11, 2019WordPress before 5.2.3 allows reflected XSS in the dashboard.CVE-2019-16221 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows reflected XSS in the dashboard.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record lists.debian.org seclists.org
Sep 11, 2019In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provideCVE-2019-16220 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org github.com
Sep 11, 2019WordPress before 5.2.3 allows XSS in shortcode previews.CVE-2019-16219 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows XSS in shortcode previews.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record fortiguard.com lists.debian.org
Sep 11, 2019WordPress before 5.2.3 allows XSS in stored comments.CVE-2019-16218 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows XSS in stored comments.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record lists.debian.org seclists.org
Sep 11, 2019WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.CVE-2019-16217 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org lists.debian.org
Sep 10, 2019An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress.CVE-2019-15896 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.
Product
An issue was discovered in the LifterLMS
Affected
up to 3.34.5
What to do
Affects up to 3.34.5. Update An issue was discovered in the LifterLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.CVE-2017-18611 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.CVE-2017-18610 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.CVE-2017-18609 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 10, 2019The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.CVE-2017-18608 · WordPress plugins & themes · reported by MITREMedium 6.1
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
Product
spotim-comments
Fixed in
4.0.4
What to do
Update spotim-comments to 4.0.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 10, 2019The avada theme before 5.1.5 for WordPress has CSRF.CVE-2017-18607 · WordPress plugins & themes · reported by MITREHigh 8.8
The avada theme before 5.1.5 for WordPress has CSRF.
Product
avada
Fixed in
5.1.5
What to do
Update avada to 5.1.5 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 10, 2019The avada theme before 5.1.5 for WordPress has stored XSS.CVE-2017-18606 · WordPress plugins & themes · reported by MITREMedium 6.1
The avada theme before 5.1.5 for WordPress has stored XSS.
Product
avada
Fixed in
5.1.5
What to do
Update avada to 5.1.5 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 10, 2019The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.CVE-2017-18605 · WordPress plugins & themes · reported by MITRECritical 9.8
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
Product
gravitate-qa-tracker
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update gravitate-qa-tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 10, 2019The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.CVE-2017-18604 · WordPress plugins & themes · reported by MITREHigh 7.5
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
Product
sitebuilder-dynamic-components
Affected
up to 1.0
What to do
Affects up to 1.0. Update sitebuilder-dynamic-components to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 10, 2019The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.CVE-2017-18603 · WordPress plugins & themes · reported by MITREMedium 6.1
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
Product
postman-smtp
Affected
up to 2017-10-04
What to do
Affects up to 2017-10-04. Update postman-smtp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Sep 10, 2019The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.CVE-2017-18602 · WordPress plugins & themes · reported by MITREHigh 8.8
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.