Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
383 results · page 8 of 8
Aug 2, 2021User Registration & User Profile – Profile Builder: Does not sanitise or escape its 'Modify default Redirect Delay timer' settingCVE-2021-24448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- User Registration & User Profile – Profile Builder
- Fixed in
- 3.4.8
- What to do
- Update User Registration & User Profile – Profile Builder to 3.4.8 or newer.
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
- Product
- About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
- Fixed in
- 1.0.7
- What to do
- Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Jul 7, 2021A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users CVE-2021-34624 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
- Product
- ProfilePress
- Affected
- 3.0.0 to 3.1.3
- What to do
- Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jul 7, 2021A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for userCVE-2021-34623 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
- Product
- ProfilePress
- Affected
- 3.0.0 to 3.1.3
- What to do
- Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jul 7, 2021A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible fCVE-2021-34622 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .
- Product
- ProfilePress
- Affected
- 3.0.0 to 3.1.3
- What to do
- Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jul 7, 2021A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible foCVE-2021-34621 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
- Product
- ProfilePress
- Affected
- 3.0.0 to 3.1.3
- What to do
- Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordfence.com
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
- Fixed in
- 4.21.1
- What to do
- Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 24, 2021Ultimate Member – User Profile, User Registration, Login & Membership: Did not properly sanitiseCVE-2021-24306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.
- Product
- Ultimate Member – User Profile, User Registration, Login & Membership
- Fixed in
- 2.1.20
- What to do
- Update Ultimate Member – User Profile, User Registration, Login & Membership to 2.1.20 or newer.
Apr 5, 2021REST API endpoint get_users in the User Profile Picture: Returned more information than was required for its functionality to users with the upload_files capabilityCVE-2021-24170 · WordPress plugins & themes · reported by WPScanHigh 7.5
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
- Product
- REST API endpoint get_users in the User Profile Picture
- Fixed in
- 2.5.0
- What to do
- Update REST API endpoint get_users in the User Profile Picture to 2.5.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update.CVE-2020-36156 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.
- Product
- An issue was discovered in the Ultimate Member
- Fixed in
- 2.1.12
- What to do
- Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD recordwordpress.orgwpscan.com
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple RCVE-2020-35935 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)
- Product
- Advanced Access Manager
- Fixed in
- 6.6.2
- What to do
- Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Nov 4, 2020Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.CVE-2020-22277 · WordPress plugins & themes · reported by MITREHigh 8
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
- Affected
- up to 1.15.5.11
- What to do
- Affects up to 1.15.5.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcert.ikiu.ac.irmega.nz
Jan 16, 2020The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.CVE-2020-7108 · WordPress plugins & themes · reported by MITREMedium 5.4
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
- Product
- LearnDash LMS
- Fixed in
- 3.1.2
- What to do
- Update LearnDash LMS to 3.1.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comlearndash.releasenotes.io
Sep 16, 2019The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.CVE-2016-10968 · WordPress plugins & themes · reported by MITREHigh 8.8
The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.
- Product
- peepso-core
- Fixed in
- 1.6.1
- What to do
- Update peepso-core to 1.6.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 3, 2019The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with theCVE-2019-15873 · WordPress plugins & themes · reported by MITREHigh 8.8
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.
- Product
- profilegrid-user-profiles-groups-and-communities
- Fixed in
- 2.8.6
- What to do
- Update profilegrid-user-profiles-groups-and-communities to 2.8.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 22, 2019The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.CVE-2015-9337 · WordPress plugins & themes · reported by MITREHigh 7.5
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
- Product
- profile-builder
- Fixed in
- 2.1.4
- What to do
- Update profile-builder to 2.1.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.CVE-2016-10911 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
- Product
- profile-builder
- Fixed in
- 2.4.2
- What to do
- Update profile-builder to 2.4.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The profile-builder plugin before 2.2.5 for WordPress has XSS.CVE-2015-9328 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 2.2.5 for WordPress has XSS.
- Product
- profile-builder
- Fixed in
- 2.2.5
- What to do
- Update profile-builder to 2.2.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-10380 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
- Product
- profile-builder
- Fixed in
- 1.1.66
- What to do
- Update profile-builder to 1.1.66 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.CVE-2019-15111 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
- Product
- wp-front-end-profile
- Fixed in
- 0.2.2
- What to do
- Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.CVE-2019-15110 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
- Product
- wp-front-end-profile
- Fixed in
- 0.2.2
- What to do
- Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Apr 3, 2019A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsCVE-2019-10673 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.
- Product
- A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member
- Fixed in
- 2.0.40
- What to do
- Update A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.phpCVE-2018-19487 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.
- Product
- WP-jobhunt
- Fixed in
- 2.4
- What to do
- Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD recordgithub.comwpvulndb.com
Oct 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0CVE-2018-17866 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field.
- Fixed in
- 2.0.28
- What to do
- Update the plugin to 2.0.28 or newer.
Full record and what to do →NVD recordserhack.mewordpress.org
May 14, 2018Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profileCVE-2018-0590 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors.
- Fixed in
- 2.0.4
- What to do
- Update the plugin to 2.0.4 or newer.
Apr 23, 2018Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input fieldCVE-2018-10234 · WordPress plugins & themes · reported by MITREMedium 4.8
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options§ion=account page.
- Product
- Authenticated Cross site Scripting exists in the User Profile & Membership
- Fixed in
- 2.0.11
- What to do
- Update Authenticated Cross site Scripting exists in the User Profile & Membership to 2.0.11 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Apr 23, 2018The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks.CVE-2018-10233 · WordPress plugins & themes · reported by MITREHigh 8.8
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin.
- Product
- User Profile & Membership
- Fixed in
- 2.0.7
- What to do
- Update User Profile & Membership to 2.0.7 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Jan 4, 2018The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.CVE-2018-5214 · WordPress plugins & themes · reported by MITREMedium 5.4
The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.
- Product
- Add Link to Facebook
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Add Link to Facebook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Oct 6, 2017Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attacCVE-2014-8492 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) site_name, (2) message, or (3) site_url parameter.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder
- Fixed in
- 2.0.3
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder to 2.0.3 or newer.
Full record and what to do →NVD recordg0blin.co.ukwpvulndb.com
Aug 31, 2015Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators toCVE-2015-6535 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
- Product
- Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed
- Fixed in
- 3.3.3
- What to do
- Update Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed to 3.3.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Dec 27, 2011Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers toCVE-2011-3841 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.
- Product
- Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium
- Fixed in
- 11.12.08
- What to do
- Update Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium to 11.12.08 or newer.
Full record and what to do →NVD recordsecunia.comsecunia.com
Aug 24, 2009ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for: SQL injectionCVE-2008-7040 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for Wordpress allows remote attackers to execute arbitrary SQL commands via the u parameter. NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
- Product
- ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for
- What to do
- Update ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for to the newest version.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Nov 21, 2006WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cCVE-2006-6017 · WordPress plugins & themes · reported by MITREMedium 6.5
WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object, because the object triggers automatic unserialization for display.
- Fixed in
- 2.0.5
- What to do
- Update the plugin to 2.0.5 or newer.
Full record and what to do →NVD recordbugs.gentoo.orgtrac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.