Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

5,867 results · page 84 of 118

Aug 22, 2019The reflex-gallery plugin before 1.4.3 for WordPress has XSS.CVE-2013-7482 · WordPress plugins & themes · reported by MITREMedium 6.1
The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
Product
reflex-gallery
Fixed in
1.4.3
What to do
Update reflex-gallery to 1.4.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The tubepress plugin before 1.6.5 for WordPress has XSS.CVE-2008-7321 · WordPress plugins & themes · reported by MITREMedium 6.1
The tubepress plugin before 1.6.5 for WordPress has XSS.
Product
tubepress
Fixed in
1.6.5
What to do
Update tubepress to 1.6.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-15318 · WordPress plugins & themes · reported by MITRECritical 9.8
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
Product
yikes-inc-easy-mailchimp-extender
Fixed in
6.5.3
What to do
Update yikes-inc-easy-mailchimp-extender to 6.5.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The give plugin before 2.4.7 for WordPress has XSS via a donor name.CVE-2019-15317 · WordPress plugins & themes · reported by MITREMedium 5.4
The give plugin before 2.4.7 for WordPress has XSS via a donor name.
Product
give
Fixed in
2.4.7
What to do
Update give to 2.4.7 or newer.
Full record and what to do →NVD record blog.sucuri.net wordpress.org
Aug 22, 2019The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.CVE-2018-20982 · WordPress plugins & themes · reported by MITREMedium 6.1
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
Product
media-library-assistant
Fixed in
2.74
What to do
Update media-library-assistant to 2.74 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · WordPress plugins & themes · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
Product
ninja-forms
Fixed in
3.3.9
What to do
Update ninja-forms to 3.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.CVE-2018-20980 · WordPress plugins & themes · reported by MITREHigh 7.5
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
Product
ninja-forms
Fixed in
3.2.15
What to do
Update ninja-forms to 3.2.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.CVE-2018-20979 · WordPress plugins & themes · reported by MITRECritical 9.8
The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.
Product
contact-form-7
Fixed in
5.0.4
What to do
Update contact-form-7 to 5.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.CVE-2017-18575 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
Product
newstatpress
Fixed in
1.2.5
What to do
Update newstatpress to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-18574 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
Product
ninja-forms
Fixed in
3.0.31
What to do
Update ninja-forms to 3.0.31 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18573 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The gnucommerce plugin before 1.4.2 for WordPress has XSS.CVE-2017-18572 · WordPress plugins & themes · reported by MITREMedium 6.1
The gnucommerce plugin before 1.4.2 for WordPress has XSS.
Product
gnucommerce
Fixed in
1.4.2
What to do
Update gnucommerce to 1.4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.CVE-2017-18571 · WordPress plugins & themes · reported by MITRECritical 9.8
The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.
Product
search-everything
Fixed in
8.1.7
What to do
Update search-everything to 8.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.CVE-2017-18570 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
Product
cforms2
Fixed in
14.13
What to do
Update cforms2 to 14.13 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.CVE-2016-10921 · WordPress plugins & themes · reported by MITRECritical 9.8
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
Product
gallery-photo-gallery
Fixed in
1.0.1
What to do
Update gallery-photo-gallery to 1.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.CVE-2016-10920 · WordPress plugins & themes · reported by MITREMedium 6.1
The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
Product
gnucommerce
Fixed in
0.5.7-BETA
What to do
Update gnucommerce to 0.5.7-BETA or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633CVE-2016-10919 · WordPress plugins & themes · reported by MITREMedium 6.1
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
Product
wassup
Fixed in
1.9.1
What to do
Update wassup to 1.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.CVE-2016-10918 · WordPress plugins & themes · reported by MITREHigh 8.8
The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
Product
gallery-by-supsystic
Fixed in
1.8.6
What to do
Update gallery-by-supsystic to 1.8.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.CVE-2016-10917 · WordPress plugins & themes · reported by MITRECritical 9.8
The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
Product
search-everything
Fixed in
8.1.6
What to do
Update search-everything to 8.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.CVE-2016-10916 · WordPress plugins & themes · reported by MITRECritical 9.8
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
Product
appointment-booking-calendar
Fixed in
1.1.24
What to do
Update appointment-booking-calendar to 1.1.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The clean-login plugin before 1.5.1 for WordPress has reflected XSS.CVE-2015-9336 · WordPress plugins & themes · reported by MITREMedium 6.1
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
Product
clean-login
Fixed in
1.5.1
What to do
Update clean-login to 1.5.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.CVE-2015-9335 · WordPress plugins & themes · reported by MITRECritical 9.8
The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.
Product
limit-attempts
Fixed in
1.1.1
What to do
Update limit-attempts to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 14.6.10 for WordPress has SQL injection.CVE-2015-9333 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
Product
cforms2
Fixed in
14.6.10
What to do
Update cforms2 to 14.6.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.CVE-2013-7481 · WordPress plugins & themes · reported by MITREMedium 6.1
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
Product
contact-form-plugin
Fixed in
3.3.5
What to do
Update contact-form-plugin to 3.3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.CVE-2013-7480 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
Product
events-manager
Fixed in
5.3.6.1
What to do
Update events-manager to 5.3.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.CVE-2013-7479 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
Product
events-manager
Fixed in
5.3.9
What to do
Update events-manager to 5.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.CVE-2013-7478 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
Product
events-manager
Fixed in
5.5
What to do
Update events-manager to 5.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.CVE-2013-7477 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
Product
events-manager
Fixed in
5.5.2
What to do
Update events-manager to 5.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.CVE-2012-6716 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
Product
events-manager
Fixed in
5.1.7
What to do
Update events-manager to 5.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.CVE-2009-5158 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.
Product
google-analyticator
Fixed in
5.2.1
What to do
Update google-analyticator to 5.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.CVE-2018-20977 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
Product
all-in-one-schemaorg-rich-snippets
Fixed in
1.5.0
What to do
Update all-in-one-schemaorg-rich-snippets to 1.5.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.CVE-2018-20970 · WordPress plugins & themes · reported by MITREMedium 6.1
The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
Product
pdf-print
Fixed in
2.0.3
What to do
Update pdf-print to 2.0.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.CVE-2017-18562 · WordPress plugins & themes · reported by MITREMedium 6.1
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
Product
error-log-viewer
Fixed in
1.0.6
What to do
Update error-log-viewer to 1.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The embed-comment-images plugin before 0.6 for WordPress has XSS.CVE-2017-18561 · WordPress plugins & themes · reported by MITREMedium 6.1
The embed-comment-images plugin before 0.6 for WordPress has XSS.
Product
embed-comment-images
Fixed in
0.6
What to do
Update embed-comment-images to 0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.CVE-2017-18559 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
Product
cforms2
Fixed in
14.13.3
What to do
Update cforms2 to 14.13.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The smokesignal plugin before 1.2.7 for WordPress has XSS.CVE-2017-18535 · WordPress plugins & themes · reported by MITREMedium 6.1
The smokesignal plugin before 1.2.7 for WordPress has XSS.
Product
smokesignal
Fixed in
1.2.7
What to do
Update smokesignal to 1.2.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The megamenu plugin before 2.4 for WordPress has XSS.CVE-2017-18525 · WordPress plugins & themes · reported by MITREMedium 6.1
The megamenu plugin before 2.4 for WordPress has XSS.
Product
megamenu
Fixed in
2.4
What to do
Update megamenu to 2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.CVE-2017-18521 · WordPress plugins & themes · reported by MITREHigh 8.8
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
Product
democracy-poll
Fixed in
5.4
What to do
Update democracy-poll to 5.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 21, 2019The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18516 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
bws-linkedin
Fixed in
1.0.5
What to do
Update bws-linkedin to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.CVE-2016-10891 · WordPress plugins & themes · reported by MITREMedium 6.1
The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
Product
aryo-activity-log
Fixed in
2.3.3
What to do
Update aryo-activity-log to 2.3.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.CVE-2016-10890 · WordPress plugins & themes · reported by MITREMedium 6.1
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
Product
aryo-activity-log
Fixed in
2.3.2
What to do
Update aryo-activity-log to 2.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The duplicate-post plugin before 2.6 for WordPress has SQL injection.CVE-2014-10379 · WordPress plugins & themes · reported by MITRECritical 9.8
The duplicate-post plugin before 2.6 for WordPress has SQL injection.
Product
duplicate-post
Fixed in
2.6
What to do
Update duplicate-post to 2.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The duplicate-post plugin before 2.6 for WordPress has XSS.CVE-2014-10378 · WordPress plugins & themes · reported by MITREMedium 6.1
The duplicate-post plugin before 2.6 for WordPress has XSS.
Product
duplicate-post
Fixed in
2.6
What to do
Update duplicate-post to 2.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.CVE-2014-10377 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
Product
cforms2
Fixed in
13.2
What to do
Update cforms2 to 13.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.CVE-2012-6714 · WordPress plugins & themes · reported by MITREMedium 6.1
The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.
Product
count-per-day
Fixed in
3.2.3
What to do
Update count-per-day to 3.2.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The sender plugin before 1.2.1 for WordPress has multiple XSS issues.CVE-2017-18564 · WordPress plugins & themes · reported by MITREMedium 6.1
The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
Product
sender
Fixed in
1.2.1
What to do
Update sender to 1.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.CVE-2017-18563 · WordPress plugins & themes · reported by MITREMedium 6.1
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
Product
rsvp
Fixed in
2.3.8
What to do
Update rsvp to 2.3.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The universal-analytics plugin before 1.3.1 for WordPress has XSS.CVE-2016-10912 · WordPress plugins & themes · reported by MITREMedium 6.1
The universal-analytics plugin before 1.3.1 for WordPress has XSS.
Product
universal-analytics
Fixed in
1.3.1
What to do
Update universal-analytics to 1.3.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.CVE-2016-10911 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
Product
profile-builder
Fixed in
2.4.2
What to do
Update profile-builder to 2.4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.CVE-2016-10910 · WordPress plugins & themes · reported by MITREMedium 6.1
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
Product
formbuilder
Fixed in
1.06
What to do
Update formbuilder to 1.06 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.