Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

5,765 results · page 82 of 116

Sep 13, 2019The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.CVE-2016-10941 · WordPress plugins & themes · reported by MITREMedium 6.1
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
Product
podlove-podcasting-plugin-for-wordpress
Fixed in
2.3.16
What to do
Update podlove-podcasting-plugin-for-wordpress to 2.3.16 or newer.
Full record and what to do →NVD record blog.ripstech.com github.com
Sep 13, 2019The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.CVE-2016-10940 · WordPress plugins & themes · reported by MITREHigh 7.2
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 13, 2019The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.CVE-2016-10939 · WordPress plugins & themes · reported by MITREHigh 7.2
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 13, 2019The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.CVE-2016-10938 · WordPress plugins & themes · reported by MITREMedium 6.5
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 11, 2019includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style SheetCVE-2019-16250 · WordPress plugins & themes · reported by MITREHigh 7.5
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.
Product
includes/wizard/wizard.php in the Ocean Extra
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update includes/wizard/wizard.php in the Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Sep 11, 2019Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).CVE-2019-14936 · WordPress plugins & themes · reported by MITREMedium 5.3
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).
Affected
1.3.2 to 1.3.2
What to do
Affects 1.3.2 to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blackdragon.team blackdragon.team
Sep 10, 2019An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress.CVE-2019-15896 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.
Product
An issue was discovered in the LifterLMS
Affected
up to 3.34.5
What to do
Affects up to 3.34.5. Update An issue was discovered in the LifterLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.CVE-2017-18611 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.CVE-2017-18610 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.CVE-2017-18609 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 10, 2019The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.CVE-2017-18608 · WordPress plugins & themes · reported by MITREMedium 6.1
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
Product
spotim-comments
Fixed in
4.0.4
What to do
Update spotim-comments to 4.0.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 10, 2019The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.CVE-2017-18605 · WordPress plugins & themes · reported by MITRECritical 9.8
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
Product
gravitate-qa-tracker
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update gravitate-qa-tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 10, 2019The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.CVE-2017-18604 · WordPress plugins & themes · reported by MITREHigh 7.5
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
Product
sitebuilder-dynamic-components
Affected
up to 1.0
What to do
Affects up to 1.0. Update sitebuilder-dynamic-components to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 10, 2019The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.CVE-2017-18603 · WordPress plugins & themes · reported by MITREMedium 6.1
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
Product
postman-smtp
Affected
up to 2017-10-04
What to do
Affects up to 2017-10-04. Update postman-smtp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Sep 10, 2019The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.CVE-2017-18602 · WordPress plugins & themes · reported by MITREHigh 8.8
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 10, 2019The examapp plugin 1.0 for WordPress has XSS via exam input text fields.CVE-2017-18601 · WordPress plugins & themes · reported by MITREMedium 5.4
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 10, 2019The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.CVE-2017-18600 · WordPress plugins & themes · reported by MITREMedium 5.4
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
Product
formcraft3
Fixed in
3.4
What to do
Update formcraft3 to 3.4 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 10, 2019The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.CVE-2017-18598 · WordPress plugins & themes · reported by MITREMedium 6.1
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
Product
Qards
Affected
up to 2017-10-11
What to do
Affects up to 2017-10-11. Update Qards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 10, 2019The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter.CVE-2017-18597 · WordPress plugins & themes · reported by MITREHigh 8.8
The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter.
Product
jtrt-responsive-tables
Fixed in
4.1.2
What to do
Update jtrt-responsive-tables to 4.1.2 or newer.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 10, 2019The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.CVE-2017-18596 · WordPress plugins & themes · reported by MITREHigh 8.8
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
Product
elementor
Fixed in
1.8.0
What to do
Update elementor to 1.8.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 9, 2019search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.CVE-2019-15895 · WordPress plugins & themes · reported by MITREHigh 7.5
search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.
Product
search-exclude.php in the "Search Exclude
Fixed in
1.2.4
What to do
Update search-exclude.php in the "Search Exclude to 1.2.4 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 9, 2019The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.CVE-2018-21014 · WordPress plugins & themes · reported by MITREMedium 5.4
The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.
Product
buddyboss-media
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update buddyboss-media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 9, 2019The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.CVE-2018-21012 · WordPress plugins & themes · reported by MITREMedium 6.1
The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.
Product
cf7-invisible-recaptcha
Fixed in
1.3.2
What to do
Update cf7-invisible-recaptcha to 1.3.2 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Sep 9, 2019The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.CVE-2018-21011 · WordPress plugins & themes · reported by MITREHigh 7.5
The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.
Product
charitable
Fixed in
1.5.14
What to do
Update charitable to 1.5.14 or newer.
Full record and what to do →NVD record wordpress.org wpcharitable.com
Sep 8, 2019CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees featureCVE-2019-16120 · WordPress plugins & themes · reported by MITREHigh 8.8
CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.
Product
CSV injection in the event-tickets (Event Tickets)
Fixed in
4.10.7.2
What to do
Update CSV injection in the event-tickets (Event Tickets) to 4.10.7.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 8, 2019SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameCVE-2019-16119 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.
Product
SQL injection in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update SQL injection in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.CVE-2019-16118 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.CVE-2019-16117 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 4, 2019cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_desCVE-2019-14470 · WordPress plugins & themes · reported by MITREMedium 6.1
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
Product
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro
Affected
up to 4.9.32
What to do
Affects up to 4.9.32. Update cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Sep 3, 2019The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] paramCVE-2019-15889 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
Product
download-manager
Fixed in
2.9.94
What to do
Update download-manager to 2.9.94 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 3, 2019The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with theCVE-2019-15873 · WordPress plugins & themes · reported by MITREHigh 8.8
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.
Product
profilegrid-user-profiles-groups-and-communities
Fixed in
2.8.6
What to do
Update profilegrid-user-profiles-groups-and-communities to 2.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-15872 · WordPress plugins & themes · reported by MITRECritical 9.8
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.CVE-2019-15871 · WordPress plugins & themes · reported by MITREMedium 4.3
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Sep 3, 2019The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.CVE-2019-15868 · WordPress plugins & themes · reported by MITREHigh 8.8
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
Product
affiliates-manager
Fixed in
2.6.6
What to do
Update affiliates-manager to 2.6.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX aCVE-2019-15867 · WordPress plugins & themes · reported by MITREHigh 8.8
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.
Product
slick-popup
Fixed in
1.7.2
What to do
Update slick-popup to 1.7.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.CVE-2019-15866 · WordPress plugins & themes · reported by MITREHigh 8.8
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.
Product
crelly-slider
Fixed in
1.3.5
What to do
Update crelly-slider to 1.3.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 3, 2019The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.CVE-2019-15865 · WordPress plugins & themes · reported by MITREHigh 8.8
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.
Product
breadcrumbs-by-menu
Fixed in
1.0.3
What to do
Update breadcrumbs-by-menu to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.CVE-2019-15864 · WordPress plugins & themes · reported by MITREMedium 6.1
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.
Product
breadcrumbs-by-menu
Fixed in
1.0.3
What to do
Update breadcrumbs-by-menu to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.CVE-2019-15863 · WordPress plugins & themes · reported by MITREHigh 7.5
The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
Product
ConvertPlus
Fixed in
3.4.5
What to do
Update ConvertPlus to 3.4.5 or newer.
Full record and what to do →NVD record convertplug.com convertplug.com
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Product
admin/includes/class.import.snippet.php in the "Woody ad snippets
Fixed in
2.2.5
What to do
Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Aug 30, 2019The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.CVE-2019-15842 · WordPress plugins & themes · reported by MITREMedium 6.1
The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
Product
easy-pdf-restaurant-menu-upload
Fixed in
1.1.2
What to do
Update easy-pdf-restaurant-menu-upload to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 30, 2019The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_viCVE-2019-15841 · WordPress plugins & themes · reported by MITREHigh 8.8
The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.
Product
facebook-for-woocommerce
Fixed in
1.9.15
What to do
Update facebook-for-woocommerce to 1.9.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 30, 2019The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.CVE-2019-15840 · WordPress plugins & themes · reported by MITREHigh 8.8
The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.
Product
facebook-for-woocommerce
Fixed in
1.9.14
What to do
Update facebook-for-woocommerce to 1.9.14 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 30, 2019The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.CVE-2019-15839 · WordPress plugins & themes · reported by MITREHigh 7.5
The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.
Product
sina-extension-for-elementor
Fixed in
2.2.1
What to do
Update sina-extension-for-elementor to 2.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.CVE-2019-15838 · WordPress plugins & themes · reported by MITREMedium 6.1
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.
Product
custom-404-pro
Fixed in
3.2.8
What to do
Update custom-404-pro to 3.2.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The webp-express plugin before 0.14.8 for WordPress has stored XSS.CVE-2019-15837 · WordPress plugins & themes · reported by MITREMedium 5.4
The webp-express plugin before 0.14.8 for WordPress has stored XSS.
Product
webp-express
Fixed in
0.14.8
What to do
Update webp-express to 0.14.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.CVE-2019-15836 · WordPress plugins & themes · reported by MITREMedium 5.4
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.
Product
wp-ultimate-recipe
Fixed in
3.12.7
What to do
Update wp-ultimate-recipe to 3.12.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.CVE-2019-15835 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.
Product
wp-better-permalinks
Fixed in
3.0.5
What to do
Update wp-better-permalinks to 3.0.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.CVE-2019-15834 · WordPress plugins & themes · reported by MITREHigh 8.8
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
Product
webp-converter-for-media
Fixed in
1.0.3
What to do
Update webp-converter-for-media to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.CVE-2019-15833 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
Product
simple-mail-address-encoder
Fixed in
1.7
What to do
Update simple-mail-address-encoder to 1.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.