Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

4,221 results · page 85 of 85

Jun 21, 2013Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authenticatioCVE-2013-3250 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode
Fixed in
1.8.8
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode to 1.8.8 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 10, 2013Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of aCVE-2013-2707 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the Login With Ajax
Fixed in
3.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Login With Ajax to 3.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 5, 2013Cross-site request forgery (CSRF) vulnerability in the Facebook Members plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication oCVE-2013-2703 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Facebook Members plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the Facebook Members
Fixed in
5.0.5
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Facebook Members to 5.0.5 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 5, 2013Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite plugin before 6.10 for WordPress allows remote attackers to hijack the authentication oCVE-2013-2702 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite plugin before 6.10 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite
Fixed in
6.10
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite to 6.10 or newer.
Full record and what to do →NVD record secunia.com secunia.com
Apr 26, 2013Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication CVE-2013-2709 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins
Fixed in
1.3
What to do
Update Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins to 1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 25, 2013Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authenticatiCVE-2013-2696 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster
Fixed in
8.2.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster to 8.2.4 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 19, 2013Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication CVE-2013-2697 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager
Fixed in
1.61
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager to 1.61 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Dec 19, 2012Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitraCVE-2012-5178 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that complete a purchase.
Product
Cross-site request forgery (CSRF) vulnerability in the Welcart
Fixed in
1.2.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Welcart to 1.2.2 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Oct 25, 2012Cross-site request forgery (CSRF) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to hijack the autheCVE-2011-5226 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to hijack the authentication of an administrator for requests that trigger snapshots.
Product
Sentinel
What to do
Update Sentinel to the newest version.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Oct 24, 2012Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack tCVE-2012-5387 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, as demonstrated by a developer name containing XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS
Fixed in
1.5.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS to 1.5.1 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Sep 28, 2012wp-admin/index.php in WordPress 3.4.2: Cross-site request forgery (CSRF)CVE-2012-4448 · WordPress plugins & themes · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action.
Product
wp-admin/index.php in WordPress 3.4.2
What to do
Update wp-admin/index.php in WordPress 3.4.2 to the newest version.
Full record and what to do →NVD record openwall.com packetstormsecurity.org
Jul 22, 2012the customizer in WordPress before 3.4.1: Cross-site request forgery (CSRF)CVE-2012-3384 · WordPress plugins & themes · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
the customizer in WordPress before 3.4.1
Fixed in
3.4.1
What to do
Update the customizer in WordPress before 3.4.1 to 3.4.1 or newer.
Full record and what to do →NVD record codex.wordpress.org openwall.com
Mar 28, 2011Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress aCVE-2011-0760 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the (1) wp_relatedposts_title, (2) wp_relatedposts_num, or (3) wp_relatedposts_type parameter.
Product
WP Related Posts
What to do
Update WP Related Posts to the newest version.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Mar 22, 2011Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remoCVE-2011-0759 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting (XSS) sequences via the (1) recaptcha_opt_pubkey, (2) recaptcha_opt_privkey, (3) re_tabindex, (4) error_blank, (5) error_incorrect, (6) mailhide_pub, (7) mailhide_priv, (8) mh_replace_link, or (9) mh_replace_title parameter.
Product
Recaptcha (aka WP-reCAPTCHA)
What to do
Update Recaptcha (aka WP-reCAPTCHA) to the newest version.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Oct 24, 2008Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackeCVE-2008-4734 · WordPress plugins & themes · reported by MITREHigh 7.5
Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to perform unauthorized actions as administrators via a request that sets the wpcr_hidden_form_input parameter.
Product
Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix
Fixed in
1.4.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix to 1.4.4 or newer.
Full record and what to do →NVD record chxsecurity.org secunia.com
Jan 31, 2008deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for: Cross-site request forgery (CSRF)CVE-2008-0508 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the oldstructure (aka dean_pm_config[oldstructure]) configuration setting as administrators via the old_struct parameter in a deans_permalinks_migration.php action to wp-admin/options-general.php, as demonstrated by placing an XSS sequence in this setting.
Product
deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for
What to do
Update deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for to the newest version.
Full record and what to do →NVD record g30rg3x.com g30rg3x.com
Jan 9, 2008Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WoCVE-2008-0205 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.
Affected
up to 2.1
What to do
Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Jan 9, 2008Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WorCVE-2008-0198 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Oct 5, 2007the FeedBurner FeedSmith 2.2 plugin for: Cross-site request forgery (CSRF)CVE-2007-5229 · WordPress plugins & themes · reported by MITREMedium 6.4
Cross-site request forgery (CSRF) vulnerability in the FeedBurner FeedSmith 2.2 plugin for WordPress allows remote attackers to change settings and hijack blog feeds via a request to wp-admin/options-general.php that submits parameter values to FeedBurner_FeedSmith_Plugin.php, as demonstrated by the (1) feedburner_url and (2) feedburner_comments_url parameters.
Product
the FeedBurner FeedSmith 2.2 plugin for
What to do
Update the FeedBurner FeedSmith 2.2 plugin for to the newest version.
Full record and what to do →NVD record blogs.feedburner.com blogsecurity.net
May 22, 2007adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for: Cross-site request forgery (CSRF)CVE-2007-2828 · WordPress plugins & themes · reported by MITREMedium 6
Cross-site request forgery (CSRF) vulnerability in adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for WordPress allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors.
Product
adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for
What to do
Update adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for to the newest version.
Full record and what to do →NVD record michaeldaw.org osvdb.org
Mar 3, 2007the AdminPanel in WordPress 2.1.1 and earlier: Cross-site request forgery (CSRF)CVE-2007-1244 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.
Product
the AdminPanel in WordPress 2.1.1 and earlier
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update the AdminPanel in WordPress 2.1.1 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.