Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

537 results · page 8 of 11

Aug 27, 2019The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.CVE-2014-10395 · WordPress plugins & themes · reported by MITREMedium 6.1
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
Product
cp-polls
Fixed in
1.0.1
What to do
Update cp-polls to 1.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The corner-ad plugin before 1.0.8 for WordPress has XSS.CVE-2017-18579 · WordPress plugins & themes · reported by MITREMedium 6.1
The corner-ad plugin before 1.0.8 for WordPress has XSS.
Product
corner-ad
Fixed in
1.0.8
What to do
Update corner-ad to 1.0.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.CVE-2014-10386 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
Product
wp-live-chat-support
Fixed in
4.1.0
What to do
Update wp-live-chat-support to 4.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.CVE-2016-10930 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
Product
wp-support-plus-responsive-ticket-system
Fixed in
7.1.0
What to do
Update wp-support-plus-responsive-ticket-system to 7.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.CVE-2016-10921 · WordPress plugins & themes · reported by MITRECritical 9.8
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
Product
gallery-photo-gallery
Fixed in
1.0.1
What to do
Update gallery-photo-gallery to 1.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.CVE-2017-18562 · WordPress plugins & themes · reported by MITREMedium 6.1
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
Product
error-log-viewer
Fixed in
1.0.6
What to do
Update error-log-viewer to 1.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18516 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
bws-linkedin
Fixed in
1.0.5
What to do
Update bws-linkedin to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.CVE-2016-10910 · WordPress plugins & themes · reported by MITREMedium 6.1
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
Product
formbuilder
Fixed in
1.06
What to do
Update formbuilder to 1.06 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-sms plugin before 1.1.0 for WordPress has XSS.CVE-2017-18555 · WordPress plugins & themes · reported by MITREMedium 6.1
The booking-sms plugin before 1.1.0 for WordPress has XSS.
Product
booking-sms
Fixed in
1.1.0
What to do
Update booking-sms to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.CVE-2016-10909 · WordPress plugins & themes · reported by MITRECritical 9.8
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.CVE-2016-10908 · WordPress plugins & themes · reported by MITREMedium 6.1
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.CVE-2017-18537 · WordPress plugins & themes · reported by MITREMedium 6.1
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
Product
visitors-online
Fixed in
1.0.0
What to do
Update visitors-online to 1.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The realty plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18532 · WordPress plugins & themes · reported by MITREMedium 6.1
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
realty
Fixed in
1.1.0
What to do
Update realty to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.CVE-2017-18527 · WordPress plugins & themes · reported by MITREMedium 6.1
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
Product
pagination
Fixed in
1.0.7
What to do
Update pagination to 1.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18518 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
bws-smtp
Fixed in
1.1.0
What to do
Update bws-smtp to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.CVE-2016-10892 · WordPress plugins & themes · reported by MITREMedium 6.1
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
Product
chained-quiz
Fixed in
1.0
What to do
Update chained-quiz to 1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.CVE-2017-18569 · WordPress plugins & themes · reported by MITREHigh 8.8
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
Product
my-wp-translate
Fixed in
1.0.4
What to do
Update my-wp-translate to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The my-wp-translate plugin before 1.0.4 for WordPress has XSS.CVE-2017-18568 · WordPress plugins & themes · reported by MITREMedium 6.1
The my-wp-translate plugin before 1.0.4 for WordPress has XSS.
Product
my-wp-translate
Fixed in
1.0.4
What to do
Update my-wp-translate to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18517 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
bws-pinterest
Fixed in
1.0.5
What to do
Update bws-pinterest to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The js-jobs plugin before 1.0.7 for WordPress has CSRF.CVE-2018-20974 · WordPress plugins & themes · reported by MITREHigh 8.8
The js-jobs plugin before 1.0.7 for WordPress has CSRF.
Product
js-jobs
Fixed in
1.0.7
What to do
Update js-jobs to 1.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18542 · WordPress plugins & themes · reported by MITREMedium 6.1
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
zendesk-help-center
Fixed in
1.0.5
What to do
Update zendesk-help-center to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.CVE-2019-14786 · WordPress plugins & themes · reported by MITREMedium 6.5
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.
Fixed in
1.0.27.1
What to do
Update the plugin to 1.0.27.1 or newer.
Full record and what to do →NVD record rankmath.com wpvulndb.com
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.1 for WordPress has SQL injection.CVE-2015-9315 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Product
newstatpress
Fixed in
1.0.1
What to do
Update newstatpress to 1.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.CVE-2015-9314 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
Product
newstatpress
Fixed in
1.0.4
What to do
Update newstatpress to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.CVE-2015-9313 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Product
newstatpress
Fixed in
1.0.5
What to do
Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.CVE-2015-9312 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Product
newstatpress
Fixed in
1.0.5
What to do
Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.CVE-2015-9311 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
Product
newstatpress
Fixed in
1.0.6
What to do
Update newstatpress to 1.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.CVE-2017-18507 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
Product
wp-live-chat-support
Fixed in
7.1.05
What to do
Update wp-live-chat-support to 7.1.05 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.CVE-2017-18508 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
Product
wp-live-chat-support
Fixed in
7.1.03
What to do
Update wp-live-chat-support to 7.1.03 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 8, 2019The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatcheCVE-2019-14774 · WordPress plugins & themes · reported by MITREMedium 6.1
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
Affected
1.0.61 to 1.0.61
What to do
Affects 1.0.61 to 1.0.61. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Jul 5, 2019Custom CSS Pro 1.0.3 and earlier: Cross-site request forgery (CSRF)CVE-2019-5984 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Custom CSS Pro 1.0.3 and earlier
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Custom CSS Pro 1.0.3 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 5, 2019Zoho SalesIQ 1.0.8 and earlier: Cross-site request forgery (CSRF)CVE-2019-5963 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Zoho SalesIQ 1.0.8 and earlier
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Zoho SalesIQ 1.0.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 5, 2019Zoho SalesIQ 1.0.8 and earlier: Cross-site scriptingCVE-2019-5962 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Zoho SalesIQ 1.0.8 and earlier
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Zoho SalesIQ 1.0.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
May 22, 2019WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/eCVE-2017-6514 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com github.com
May 13, 2019The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.CVE-2019-9618 · WordPress plugins & themes · reported by MITRECritical 9.8
The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
May 13, 2019Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web scripCVE-2019-7411 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL).
Product
MyThemeShop Launcher
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update MyThemeShop Launcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record metamorfosec.com wpvulndb.com
Apr 26, 2019The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inCVE-2019-11557 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form Builder
Fixed in
1.0.69
What to do
Update WebDorado Contact Form Builder to 1.0.69 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating fCVE-2015-4617 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.
Affected
1.09 to 1.09
What to do
Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXMLCVE-2015-4615 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables
Affected
1.09 to 1.09
What to do
Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org wordpress.org
Jan 9, 2019the LearnPress prior to version 3.1.0: SQL injectionCVE-2018-16175 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.2
SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
Product
the LearnPress prior to version 3.1.0
Fixed in
3.1.0
What to do
Update the LearnPress prior to version 3.1.0 to 3.1.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 9, 2019LearnPress prior to version 3.1.0: Open redirectCVE-2018-16174 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Product
LearnPress prior to version 3.1.0
Fixed in
3.1.0
What to do
Update LearnPress prior to version 3.1.0 to 3.1.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 9, 2019LearnPress prior to version 3.1.0: Cross-site scriptingCVE-2018-16173 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
LearnPress prior to version 3.1.0
Fixed in
3.1.0
What to do
Update LearnPress prior to version 3.1.0 to 3.1.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 25, 2018An issue was discovered in the JSmol2WP plugin 1.07 for WordPress.CVE-2018-20463 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF.
Product
JSmol2WP
Affected
1.07 to 1.07
What to do
Affects 1.07 to 1.07. Update JSmol2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com cbiu.cc
Dec 25, 2018An issue was discovered in the JSmol2WP plugin 1.07 for WordPress.CVE-2018-20462 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter.
Product
JSmol2WP
Affected
1.07 to 1.07
What to do
Affects 1.07 to 1.07. Update JSmol2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com cbiu.cc
Sep 24, 2018The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.CVE-2018-16299 · WordPress plugins & themes · reported by MITREHigh 7.5
The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org github.com
Jun 1, 2018An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress.CVE-2018-11486 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CSS textarea field, which will be loaded on every site page.
Product
MULTIDOTS Advance Search for WooCommerce
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update MULTIDOTS Advance Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com labs.threatpress.com
Jun 1, 2018MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier: Stored XSSCVE-2018-11485 · WordPress plugins & themes · reported by MITREMedium 6.1
The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack is possible by modifying the "referral_site" cookie to have an XSS payload, and placing an order.
Product
MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com labs.threatpress.com
May 31, 2018An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress.CVE-2018-11632 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings via wp-admin/admin-post.php CSRF. There's no nonce or capability check in the whatsapp_share_setting_add_update() function.
Product
MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com wordpress.org
May 30, 2018class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change VulnerCVE-2018-11579 · WordPress plugins & themes · reported by MITREMedium 5.3
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
Product
MULTIDOTS WooCommerce Category Banner Management
Affected
1.1.0 to 1.1.0
What to do
Affects 1.1.0 to 1.1.0. Update MULTIDOTS WooCommerce Category Banner Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record labs.threatpress.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.