Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,119 results · page 8 of 23

Mar 13, 2020An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an CVE-2020-10196 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several of the popup's fields by sending a request to wp-admin/admin-ajax.php with the POST action parameter of sgpb_autosave and including additional data in an allPopupData parameter, including the popup's ID (which is visible in the source of the page in which the popup is inserted) and arbitrary JavaScript which will then be executed in the browsers of visitors to that page. Because the plugin functionality automatically adds script tags to data entered into these fields, this injection will typically bypass most WAF applications.
Product
An XSS vulnerability in the popup-builder
Fixed in
3.64.1
What to do
Update An XSS vulnerability in the popup-builder to 3.64.1 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Mar 6, 2020A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator tCVE-2020-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
Product
A CSRF vulnerability in the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update A CSRF vulnerability in the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 13, 2020Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the polliCVE-2013-1400 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Feb 4, 2020A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malCVE-2020-8615 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
Product
A CSRF vulnerability in the Tutor LMS
Fixed in
1.5.3
What to do
Update A CSRF vulnerability in the Tutor LMS to 1.5.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Feb 3, 2020Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.CVE-2020-8549 · WordPress plugins & themes · reported by MITREMedium 6.1
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
Product
Stored XSS in the Strong Testimonials
Fixed in
2.40.1
What to do
Update Stored XSS in the Strong Testimonials to 2.40.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jan 30, 2020Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web scCVE-2013-4241 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
Product
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials
Fixed in
2.0.11
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.
Full record and what to do →NVD record seclists.org seclists.org
Jan 28, 2020Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication ofCVE-2015-5483 · WordPress plugins & themes · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.
Product
Private Only
Affected
3.5.1 to 3.5.1
What to do
Affects 3.5.1 to 3.5.1. Update Private Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 28, 2020Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parametCVE-2013-2714 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parameter.
Affected
8.8.10.13 to 8.8.10.13
What to do
Affects 8.8.10.13 to 8.8.10.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jan 23, 2020WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.CVE-2012-6649 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.
Affected
1.1.21 to 1.1.21
What to do
Affects 1.1.21 to 1.1.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 9, 2020A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify severalCVE-2020-6167 · WordPress plugins & themes · reported by MITREHigh 8.8
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo.
Affected
up to 2.10
What to do
Affects up to 2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 2, 2020Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTMCVE-2014-4553 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters.
Product
spreadshirt-rss-3d-cube-flash-gallery
Affected
2014 to 2014
What to do
Affects 2014 to 2014. Update spreadshirt-rss-3d-cube-flash-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jan 2, 2020The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an emailCVE-2019-20203 · WordPress plugins & themes · reported by MITREMedium 5.3
The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.
Product
Postie
Affected
up to 1.9.40
What to do
Affects up to 1.9.40. Update Postie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com postieplugin.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers tCVE-2014-4550 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
Product
Shortcode Ninja
Affected
up to 1.4
What to do
Affects up to 1.4. Update Shortcode Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script CVE-2014-4535 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
Product
Import Legacy Media
Affected
up to 0.1
What to do
Affects up to 0.1. Update Import Legacy Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackersCVE-2014-4558 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
Product
Swipe Checkout for WooCommerce
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Swipe Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrCVE-2014-4548 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the popup parameter.
Product
Ruven Toolkit
Affected
up to 1.1
What to do
Affects up to 1.1. Update Ruven Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script orCVE-2014-4544 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php.
Product
Podcast Channels
Affected
up to 0.20
What to do
Affects up to 0.20. Update Podcast Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2014-4539 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
Product
Movies
Affected
up to 0.6
What to do
Affects up to 0.6. Update Movies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to CVE-2014-4592 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Product
WP-Planet
Affected
up to 0.1
What to do
Affects up to 0.1. Update WP-Planet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2014-4519 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the 'page' parameter.
Product
Conversador
Affected
up to 2.61
What to do
Affects up to 2.61. Update Conversador to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web scriptCVE-2014-4523 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Product
Easy Career Openings
Affected
up to 0.4
What to do
Affects up to 0.4. Update Easy Career Openings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization,CVE-2019-20041 · WordPress plugins & themes · reported by MITRECritical 9.8
wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript&colon; substring.
Fixed in
5.3.1
What to do
Update the plugin to 5.3.1 or newer.
Full record and what to do →NVD record github.com lists.debian.org
Dec 26, 2019WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code.CVE-2013-2011 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009.
Fixed in
1.3.2
What to do
Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Dec 25, 2019A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affectinCVE-2019-19979 · WordPress plugins & themes · reported by MITREHigh 8.8
A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS.
Fixed in
5.0.6
What to do
Update the plugin to 5.0.6 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Dec 11, 2019Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbCVE-2013-5978 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977.
Product
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite
Fixed in
1.5.1.15
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite to 1.5.1.15 or newer.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Nov 18, 2019The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album,CVE-2019-14467 · WordPress plugins & themes · reported by MITREHigh 7.8
The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 23, 2019The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5CVE-2015-9507 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org
Oct 17, 2019WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.CVE-2019-17672 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org seclists.org
Oct 11, 2019The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, uCVE-2015-9492 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers SmartIT Premium Responsive
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers SmartIT Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, CVE-2015-9491 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Blessing Premium Responsive
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Blessing Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_passCVE-2015-9490 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers GamesTheme Premium
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers GamesTheme Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, uCVE-2015-9489 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Goodnex Premium Responsive
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Goodnex Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (suCVE-2015-9488 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Almera Responsive Portfolio Site Template component
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Almera Responsive Portfolio Site Template component to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, CVE-2015-9487 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Almera Responsive Portfolio
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Almera Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, usCVE-2015-9486 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Axioma Premium Responsive
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Axioma Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive informatCVE-2015-9485 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Accio Responsive Parallax One Page Site Template component
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Accio Responsive Parallax One Page Site Template component to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_CVE-2015-9484 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Accio One Page Parallax Responsive
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Accio One Page Parallax Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive informatCVE-2015-9483 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Invento Responsive Gallery/Architecture Template component
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Invento Responsive Gallery/Architecture Template component to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as userCVE-2015-9482 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Car Dealer / Auto Dealer Responsive
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Car Dealer / Auto Dealer Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 11, 2019The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_paCVE-2015-9481 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Product
ThemeMakers Diplomat | Political
Affected
up to 2015-05-15
What to do
Affects up to 2015-05-15. Update ThemeMakers Diplomat | Political to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 3, 2019A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or otheCVE-2019-16931 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
Product
Visualizer
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Visualizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record nathandavison.com wordpress.org
Sep 25, 2019The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.CVE-2015-9418 · WordPress plugins & themes · reported by MITREMedium 4.3
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.
Product
Watu Pro
Fixed in
4.9.0.8
What to do
Update Watu Pro to 4.9.0.8 or newer.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 20, 2019Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a ..CVE-2015-9406 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.
Product
Directory traversal vulnerability in the mTheme-Unus
Fixed in
2.3
What to do
Update Directory traversal vulnerability in the mTheme-Unus to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 11, 2019WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacCVE-2019-16222 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org github.com
Sep 11, 2019WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.CVE-2019-16217 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org lists.debian.org
Aug 28, 2019The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.CVE-2017-18593 · WordPress plugins & themes · reported by MITREMedium 6.1
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
Product
updraftplus
Fixed in
1.13.5
What to do
Update updraftplus to 1.13.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.CVE-2019-14793 · WordPress plugins & themes · reported by MITREMedium 6.5
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
Product
Meta Box
Fixed in
4.16.3
What to do
Update Meta Box to 4.16.3 or newer.
Full record and what to do →NVD record metabox.io pluginvulnerabilities.com
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Product
codection "Import users from CSV with meta
Fixed in
1.14.2.2
What to do
Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 30, 2019A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.CVE-2019-14327 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
Product
Custom Simple Rss
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Custom Simple Rss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 29, 2019The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_foCVE-2019-6726 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header.
Product
WP Fastest Cache
Affected
up to 0.8.9.0
What to do
Affects up to 0.8.9.0. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.