Updated 0 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

5,765 results · page 80 of 116

Sep 25, 2019The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.CVE-2015-9414 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
Product
wp-symposium
Affected
up to 15.8.1
What to do
Affects up to 15.8.1. Update wp-symposium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.CVE-2015-9413 · WordPress plugins & themes · reported by MITREMedium 6.5
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Product
eshop
Affected
up to 6.3.13
What to do
Affects up to 6.3.13. Update eshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.CVE-2015-9412 · WordPress plugins & themes · reported by MITREMedium 6.1
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.
Product
Royal-Slider
Fixed in
3.2.7
What to do
Update Royal-Slider to 3.2.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The Postmatic plugin before 1.4.6 for WordPress has XSS.CVE-2015-9411 · WordPress plugins & themes · reported by MITREMedium 6.1
The Postmatic plugin before 1.4.6 for WordPress has XSS.
Product
Postmatic
Fixed in
1.4.6
What to do
Update Postmatic to 1.4.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.CVE-2015-9410 · WordPress plugins & themes · reported by MITREMedium 5.4
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.
Affected
6.0.4 to 6.0.4
What to do
Affects 6.0.4 to 6.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com github.com
Sep 25, 2019The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.CVE-2015-9409 · WordPress plugins & themes · reported by MITREMedium 6.5
The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.
Product
alo-easymail
Fixed in
2.6.01
What to do
Update alo-easymail to 2.6.01 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.CVE-2015-9408 · WordPress plugins & themes · reported by MITREMedium 6.5
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
Product
xpinner-lite
Affected
up to 2.2
What to do
Affects up to 2.2. Update xpinner-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.CVE-2015-9407 · WordPress plugins & themes · reported by MITREMedium 6.1
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
Product
xpinner-lite
Affected
up to 2.2
What to do
Affects up to 2.2. Update xpinner-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The wp-piwik plugin before 1.0.5 for WordPress has XSS.CVE-2015-9405 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-piwik plugin before 1.0.5 for WordPress has XSS.
Product
wp-piwik
Fixed in
1.0.5
What to do
Update wp-piwik to 1.0.5 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 20, 2019The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.CVE-2015-9404 · WordPress plugins & themes · reported by MITREMedium 6.1
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.CVE-2015-9403 · WordPress plugins & themes · reported by MITREMedium 6.1
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.CVE-2015-9402 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
Product
users-ultra
Fixed in
1.5.59
What to do
Update users-ultra to 1.5.59 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.CVE-2015-9401 · WordPress plugins & themes · reported by MITREMedium 4.8
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
Product
websimon-tables
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update websimon-tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.CVE-2015-9400 · WordPress plugins & themes · reported by MITREHigh 8.8
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
Product
wordpress-meta-robots
Affected
up to 2.1
What to do
Affects up to 2.1. Update wordpress-meta-robots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.CVE-2015-9399 · WordPress plugins & themes · reported by MITREHigh 7.2
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
Product
wp-stats-dashboard
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update wp-stats-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.CVE-2015-9398 · WordPress plugins & themes · reported by MITREHigh 8.8
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
Product
gocodes
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update gocodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.CVE-2015-9397 · WordPress plugins & themes · reported by MITREMedium 5.4
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Product
gocodes
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update gocodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.CVE-2015-9396 · WordPress plugins & themes · reported by MITREMedium 6.1
The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.
Product
auto-thickbox-plus
Affected
up to 1.9
What to do
Affects up to 1.9. Update auto-thickbox-plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.CVE-2015-9395 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
Product
users-ultra
Fixed in
1.5.64
What to do
Update users-ultra to 1.5.64 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.CVE-2015-9394 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.CVE-2015-9393 · WordPress plugins & themes · reported by MITREMedium 5.4
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.CVE-2015-9392 · WordPress plugins & themes · reported by MITREMedium 5.4
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.CVE-2016-11013 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.
Product
wp-listings
Fixed in
2.0.2
What to do
Update wp-listings to 2.0.2 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 20, 2019The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.CVE-2016-11012 · WordPress plugins & themes · reported by MITREMedium 5.4
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
Product
sola-support-tickets
Fixed in
3.13
What to do
Update sola-support-tickets to 3.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.CVE-2016-11011 · WordPress plugins & themes · reported by MITREMedium 6.5
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.CVE-2016-11010 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.CVE-2016-11009 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.CVE-2016-11008 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.CVE-2016-11007 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.CVE-2016-11006 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.CVE-2016-11005 · WordPress plugins & themes · reported by MITREMedium 6.1
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
Product
instalinker
Fixed in
1.1.2
What to do
Update instalinker to 1.1.2 or newer.
Full record and what to do →NVD record rastating.github.io wordpress.org
Sep 20, 2019The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.CVE-2016-11004 · WordPress plugins & themes · reported by MITREHigh 8.8
The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.
Product
Elegant Themes Monarch
Fixed in
1.2.7
What to do
Update Elegant Themes Monarch to 1.2.7 or newer.
Full record and what to do →NVD record pritect.net wptavern.com
Sep 20, 2019The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.CVE-2016-11003 · WordPress plugins & themes · reported by MITREHigh 8.8
The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.
Product
Elegant Themes Bloom
Fixed in
1.1.1
What to do
Update Elegant Themes Bloom to 1.1.1 or newer.
Full record and what to do →NVD record pritect.net wptavern.com
Sep 20, 2019The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.CVE-2016-11001 · WordPress plugins & themes · reported by MITREMedium 6.1
The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.
Product
user-submitted-posts
Fixed in
20160215
What to do
Update user-submitted-posts to 20160215 or newer.
Full record and what to do →NVD record wordpress.org securityfocus.com
Sep 20, 2019The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.CVE-2016-11000 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.
Product
wp-ultimate-exporter
Affected
up to 1.1
What to do
Affects up to 1.1. Update wp-ultimate-exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.CVE-2016-10998 · WordPress plugins & themes · reported by MITREMedium 6.1
The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.
Product
ocim-mp3
Affected
up to 2016-03-07
What to do
Affects up to 2016-03-07. Update ocim-mp3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 20, 2019The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.CVE-2016-10996 · WordPress plugins & themes · reported by MITREMedium 5.3
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
Product
optinmonster
Fixed in
1.1.4.6
What to do
Update optinmonster to 1.1.4.6 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.CVE-2015-9391 · WordPress plugins & themes · reported by MITREMedium 6.1
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.
Product
yawpp
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update yawpp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.CVE-2015-9390 · WordPress plugins & themes · reported by MITREMedium 4.3
The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
Product
admin-management-xtended
Fixed in
2.4.0.1
What to do
Update admin-management-xtended to 2.4.0.1 or newer.
Full record and what to do →NVD record security.szurek.pl wordpress.org
Sep 20, 2019The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.CVE-2015-9389 · WordPress plugins & themes · reported by MITREMedium 5.4
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
Product
mtouch-quiz
Fixed in
3.1.3
What to do
Update mtouch-quiz to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org davidsopas.com
Sep 20, 2019The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.CVE-2015-9388 · WordPress plugins & themes · reported by MITREMedium 6.5
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
Product
mtouch-quiz
Fixed in
3.1.3
What to do
Update mtouch-quiz to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org davidsopas.com
Sep 20, 2019The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.CVE-2015-9387 · WordPress plugins & themes · reported by MITREMedium 6.5
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.
Product
mtouch-quiz
Fixed in
3.1.3
What to do
Update mtouch-quiz to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org davidsopas.com
Sep 20, 2019The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.CVE-2015-9386 · WordPress plugins & themes · reported by MITREMedium 6.1
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
Product
mtouch-quiz
Fixed in
3.1.3
What to do
Update mtouch-quiz to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org davidsopas.com
Sep 20, 2019The quotes-and-tips plugin before 1.20 for WordPress has XSS.CVE-2015-9385 · WordPress plugins & themes · reported by MITREMedium 6.1
The quotes-and-tips plugin before 1.20 for WordPress has XSS.
Product
quotes-and-tips
Fixed in
1.20
What to do
Update quotes-and-tips to 1.20 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The relevant plugin before 1.0.8 for WordPress has XSS.CVE-2015-9384 · WordPress plugins & themes · reported by MITREMedium 6.1
The relevant plugin before 1.0.8 for WordPress has XSS.
Product
relevant
Fixed in
1.0.8
What to do
Update relevant to 1.0.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 19, 2019An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress.CVE-2019-16525 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.
Product
An XSS issue was discovered in the checklist
Fixed in
1.1.9
What to do
Update An XSS issue was discovered in the checklist to 1.1.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 18, 2019The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.CVE-2016-10995 · WordPress plugins & themes · reported by MITRECritical 9.8
The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.
Product
Tevolution
Fixed in
2.3.0
What to do
Update Tevolution to 2.3.0 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 17, 2019The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.CVE-2016-10992 · WordPress plugins & themes · reported by MITREMedium 6.1
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
Product
music-store
Fixed in
1.0.43
What to do
Update music-store to 1.0.43 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 17, 2019The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.CVE-2016-10991 · WordPress plugins & themes · reported by MITREHigh 7.5
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.
Product
imdb-widget
Fixed in
1.0.9
What to do
Update imdb-widget to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 17, 2019The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.CVE-2016-10990 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
Product
wp-cerber
Fixed in
2.7
What to do
Update wp-cerber to 2.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.