Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

389 results · page 8 of 8

Sep 20, 2019The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.CVE-2016-11004 · WordPress plugins & themes · reported by MITREHigh 8.8
The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.
Product
Elegant Themes Monarch
Fixed in
1.2.7
What to do
Update Elegant Themes Monarch to 1.2.7 or newer.
Full record and what to do →NVD record pritect.net wptavern.com
Sep 20, 2019The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.CVE-2016-10996 · WordPress plugins & themes · reported by MITREMedium 5.3
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
Product
optinmonster
Fixed in
1.1.4.6
What to do
Update optinmonster to 1.1.4.6 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 13, 2019The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= CVE-2019-12516 · WordPress plugins & themes · reported by MITREHigh 8.8
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI.
Product
slickquiz
Affected
up to 1.3.7.1
What to do
Affects up to 1.3.7.1. Update slickquiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 9, 2019The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath toCVE-2018-21013 · WordPress plugins & themes · reported by MITRECritical 9.8
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.
Product
Swape
Fixed in
1.2.1
What to do
Update Swape to 1.2.1 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 3, 2019The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] paramCVE-2019-15889 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
Product
download-manager
Fixed in
2.9.94
What to do
Update download-manager to 2.9.94 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Product
admin/includes/class.import.snippet.php in the "Woody ad snippets
Fixed in
2.2.5
What to do
Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Aug 29, 2019The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.CVE-2019-15777 · WordPress plugins & themes · reported by MITREMedium 5.4
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
Product
shapepress-dsgvo
Fixed in
2.2.19
What to do
Update shapepress-dsgvo to 2.2.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.CVE-2017-18558 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
Product
bws-testimonials
Fixed in
0.1.9
What to do
Update bws-testimonials to 0.1.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.CVE-2016-10897 · WordPress plugins & themes · reported by MITREMedium 6.1
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
Product
sermon-browser
Fixed in
0.45.16
What to do
Update sermon-browser to 0.45.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.CVE-2017-18533 · WordPress plugins & themes · reported by MITREMedium 6.1
The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
Product
rimons-twitter-widget
Fixed in
1.3
What to do
Update rimons-twitter-widget to 1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.CVE-2015-9296 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Product
download-monitor
Fixed in
1.7.1
What to do
Update download-monitor to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated byCVE-2016-10865 · WordPress plugins & themes · reported by MITREMedium 6.1
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
Product
Lightbox Plus Colorbox
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Lightbox Plus Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Jul 11, 2019The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.CVE-2019-13505 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
Affected
1.1.44 to 1.1.44
What to do
Affects 1.1.44 to 1.1.44. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
May 13, 2019The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstratCVE-2019-11886 · WordPress plugins & themes · reported by MITREHigh 8.8
The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.
Product
WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer)
Fixed in
7.2.1
What to do
Update WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) to 7.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Dec 20, 2018The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.CVE-2018-14846 · WordPress plugins & themes · reported by MITREMedium 5.4
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.
Product
Mondula Multi Step Form
Fixed in
1.2.8
What to do
Update Mondula Multi Step Form to 1.2.8 or newer.
Full record and what to do →NVD record ansawaf.blogspot.com cwatch.comodo.com
Nov 26, 2018Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress.CVE-2018-19564 · WordPress plugins & themes · reported by MITREMedium 6.1
Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.
Product
Easy Testimonials
Affected
3.2 to 3.2
What to do
Affects 3.2 to 3.2. Update Easy Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 1, 2018XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.CVE-2015-9270 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
Product
XSS exists in the the-holiday-calendar
Fixed in
1.11.3
What to do
Update XSS exists in the the-holiday-calendar to 1.11.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Aug 26, 2018Plainview Activity Monitor plugin before 20180826: OS command injectionCVE-2018-15877 · WordPress plugins & themes · reported by MITREHigh 8.8
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request.
Product
Plainview Activity Monitor plugin before 20180826
Fixed in
20180826
What to do
Update Plainview Activity Monitor plugin before 20180826 to 20180826 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 25, 2018The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email fCVE-2018-14430 · WordPress plugins & themes · reported by MITREMedium 6.1
The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.
Product
Mondula Multi Step Form
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Mondula Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hackpuntes.com wpvulndb.com
May 30, 2018Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter.CVE-2018-11568 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the '<' and '>' characters have < and > representations.
Product
Reflected XSS is possible in the GamePlan
Affected
up to 1.5.13.2
What to do
Affects up to 1.5.13.2. Update Reflected XSS is possible in the GamePlan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Mar 14, 2018A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode paCVE-2018-8711 · WordPress plugins & themes · reported by MITRECritical 9.8
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.
Product
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF)
Fixed in
2.2.0
What to do
Update A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD record sec-consult.com wordpress.org
Mar 14, 2018A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode pCVE-2018-8710 · WordPress plugins & themes · reported by MITRECritical 9.8
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.
Product
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF)
Fixed in
2.2.0
What to do
Update A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD record sec-consult.com wordpress.org
Jan 12, 2018The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5372 · WordPress plugins & themes · reported by MITREHigh 8.8
The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
Product
Testimonial Slider
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.phCVE-2018-5213 · WordPress plugins & themes · reported by MITREMedium 5.4
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
Product
Simple Download Monitor
Fixed in
3.5.4
What to do
Update Simple Download Monitor to 3.5.4 or newer.
Full record and what to do →NVD record github.com github.com
Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/CVE-2018-5212 · WordPress plugins & themes · reported by MITREMedium 5.4
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.
Product
Simple Download Monitor
Fixed in
3.5.4
What to do
Update Simple Download Monitor to 3.5.4 or newer.
Full record and what to do →NVD record github.com github.com
Sep 17, 2017WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstraCVE-2017-14530 · WordPress plugins & themes · reported by MITREHigh 8
WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences.
Product
WP_Admin_UI in the Crony Cronjob Manager
Fixed in
0.4.7
What to do
Update WP_Admin_UI in the Crony Cronjob Manager to 0.4.7 or newer.
Full record and what to do →NVD record cybersecurityworks.com github.com
Aug 1, 2017The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More TCVE-2017-12131 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.
Affected
3.0.4 to 3.0.4
What to do
Affects 3.0.4 to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jun 12, 2017SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid paraCVE-2017-9418 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php.
Product
WP-Testimonials
Affected
3.4.1 to 3.4.1
What to do
Affects 3.4.1 to 3.4.1. Update WP-Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
May 17, 2017Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers toCVE-2015-3998 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
Product
adsense-click-fraud-monitoring
Affected
1.7.5 to 1.7.5
What to do
Affects 1.7.5 to 1.7.5. Update adsense-click-fraud-monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Sep 4, 2014Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2012-4768 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.
Product
Cross-site scripting (XSS) vulnerability in the Download Monitor
Fixed in
3.3.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in the Download Monitor to 3.3.5.9 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Apr 2, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the autheCVE-2013-4240 · WordPress plugins & themes · reported by Red HatMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add new groups via the hms-testimonials-addnewgroup page, (3) change default settings via the hms-testimonials-settings page, (4) change advanced settings via the hms-testimonials-settings-advanced page, (5) change custom fields settings via the hms-testimonials-settings-fields page, or (6) change template settings via the hms-testimonials-templates-new page to wp-admin/admin.php.
Product
Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials
Fixed in
2.0.11
What to do
Update Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.
Full record and what to do →NVD record osvdb.org seclists.org
Sep 10, 2013SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands viCVE-2013-5673 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php.
Product
IndiaNIC Testimonial
What to do
Update IndiaNIC Testimonial to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Sep 10, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authenticatCVE-2013-5672 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add a testimonial via an iNIC_testimonial_save action; (2) add a listing template via an iNIC_testimonial_save_listing_template action; (3) add a widget template via an iNIC_testimonial_save_widget action; insert cross-site scripting (XSS) sequences via the (4) project_name, (5) project_url, (6) client_name, (7) client_city, (8) client_state, (9) description, (10) tags, (11) video_url, or (12) is_featured, (13) title, (14) widget_title, (15) no_of_testimonials, (16) filter_by_country, (17) filter_by_tags, or (18) widget_template parameter to wp-admin/admin-ajax.php.
Product
IndiaNIC Testimonial
What to do
Update IndiaNIC Testimonial to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-5098 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-3262 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Dec 28, 2009SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2009-4424 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Pyrmont
What to do
Update Pyrmont to the newest version.
Full record and what to do →NVD record packetstormsecurity.org exploit-db.com
Jun 19, 2009SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands CVE-2009-2122 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Paolo Palmonari Photoracer
What to do
Update Paolo Palmonari Photoracer to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Apr 30, 2008wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for: SQL injectionCVE-2008-2034 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for
What to do
Update wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Feb 11, 2008Multiple cross-site scripting (XSS) vulnerabilities in admin_panel.php in the Simon Elvery WP-Footnotes 2.2 plugin for WordPress allow remote attackers to injecCVE-2008-0691 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in admin_panel.php in the Simon Elvery WP-Footnotes 2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wp_footnotes_current_settings[priority], (2) wp_footnotes_current_settings[style_rules], (3) wp_footnotes_current_settings[pre_footnotes], and (4) wp_footnotes_current_settings[post_footnotes] parameters.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.