Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

5,867 results · page 85 of 118

Aug 21, 2019The profile-builder plugin before 2.2.5 for WordPress has XSS.CVE-2015-9328 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 2.2.5 for WordPress has XSS.
Product
profile-builder
Fixed in
2.2.5
What to do
Update profile-builder to 2.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.CVE-2015-9327 · WordPress plugins & themes · reported by MITREMedium 6.1
The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.
Product
flickr-justified-gallery
Fixed in
3.4.0
What to do
Update flickr-justified-gallery to 3.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-10380 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
Product
profile-builder
Fixed in
1.1.66
What to do
Update profile-builder to 1.1.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.CVE-2012-6715 · WordPress plugins & themes · reported by MITREMedium 6.1
The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.
Product
formbuilder
Fixed in
0.9.1
What to do
Update formbuilder to 0.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-slimstat plugin before 4.8.1 for WordPress has XSS.CVE-2019-15112 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat plugin before 4.8.1 for WordPress has XSS.
Product
wp-slimstat
Fixed in
4.8.1
What to do
Update wp-slimstat to 4.8.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.CVE-2019-15111 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
Product
wp-front-end-profile
Fixed in
0.2.2
What to do
Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.CVE-2019-15110 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
Product
wp-front-end-profile
Fixed in
0.2.2
What to do
Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The updater plugin before 1.35 for WordPress has multiple XSS issues.CVE-2017-18565 · WordPress plugins & themes · reported by MITREMedium 6.1
The updater plugin before 1.35 for WordPress has multiple XSS issues.
Product
updater
Fixed in
1.35
What to do
Update updater to 1.35 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The content-audit plugin before 1.9.2 for WordPress has XSS.CVE-2017-18560 · WordPress plugins & themes · reported by MITREMedium 6.1
The content-audit plugin before 1.9.2 for WordPress has XSS.
Product
content-audit
Fixed in
1.9.2
What to do
Update content-audit to 1.9.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.CVE-2017-18558 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
Product
bws-testimonials
Fixed in
0.1.9
What to do
Update bws-testimonials to 0.1.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.CVE-2017-18557 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
Product
bws-google-maps
Fixed in
1.3.6
What to do
Update bws-google-maps to 1.3.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.CVE-2017-18556 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
Product
bws-google-analytics
Fixed in
1.7.1
What to do
Update bws-google-analytics to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-sms plugin before 1.1.0 for WordPress has XSS.CVE-2017-18555 · WordPress plugins & themes · reported by MITREMedium 6.1
The booking-sms plugin before 1.1.0 for WordPress has XSS.
Product
booking-sms
Fixed in
1.1.0
What to do
Update booking-sms to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.CVE-2017-18554 · WordPress plugins & themes · reported by MITREMedium 6.1
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
Product
analytics-tracker
Fixed in
1.1.1
What to do
Update analytics-tracker to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The ad-buttons plugin before 2.3.2 for WordPress has XSS.CVE-2017-18553 · WordPress plugins & themes · reported by MITREMedium 6.1
The ad-buttons plugin before 2.3.2 for WordPress has XSS.
Product
ad-buttons
Fixed in
2.3.2
What to do
Update ad-buttons to 2.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.CVE-2016-10909 · WordPress plugins & themes · reported by MITRECritical 9.8
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.CVE-2016-10908 · WordPress plugins & themes · reported by MITREMedium 6.1
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
Product
booking-calendar-contact-form
Fixed in
1.0.24
What to do
Update booking-calendar-contact-form to 1.0.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.CVE-2016-10903 · WordPress plugins & themes · reported by MITREHigh 8.8
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
Product
GoDaddy godaddy-email-marketing-sign-up-forms
Fixed in
1.1.3
What to do
Update GoDaddy godaddy-email-marketing-sign-up-forms to 1.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.CVE-2016-10902 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
Product
wp-customer-reviews
Fixed in
3.0.9
What to do
Update wp-customer-reviews to 3.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.CVE-2016-10901 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
Product
wp-customer-reviews
Fixed in
3.0.9
What to do
Update wp-customer-reviews to 3.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The uji-countdown plugin before 2.0.7 for WordPress has XSS.CVE-2016-10900 · WordPress plugins & themes · reported by MITREMedium 6.1
The uji-countdown plugin before 2.0.7 for WordPress has XSS.
Product
uji-countdown
Fixed in
2.0.7
What to do
Update uji-countdown to 2.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.CVE-2019-15109 · WordPress plugins & themes · reported by MITREMedium 6.1
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
Product
the-events-calendar
Fixed in
4.8.2
What to do
Update the-events-calendar to 4.8.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.CVE-2017-18540 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.7
What to do
Update weblibrarian to 3.4.8.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.CVE-2017-18539 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.6
What to do
Update weblibrarian to 3.4.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.CVE-2017-18538 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.5
What to do
Update weblibrarian to 3.4.8.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.CVE-2017-18537 · WordPress plugins & themes · reported by MITREMedium 6.1
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
Product
visitors-online
Fixed in
1.0.0
What to do
Update visitors-online to 1.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.CVE-2017-18536 · WordPress plugins & themes · reported by MITREMedium 6.1
The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
Product
stop-user-enumeration
Fixed in
1.3.8
What to do
Update stop-user-enumeration to 1.3.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.CVE-2017-18534 · WordPress plugins & themes · reported by MITREMedium 6.1
The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
Product
share-on-diaspora
Fixed in
0.7.2
What to do
Update share-on-diaspora to 0.7.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.CVE-2016-10899 · WordPress plugins & themes · reported by MITREMedium 5.3
The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
Product
total-security
Fixed in
3.4.1
What to do
Update total-security to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The total-security plugin before 3.4.1 for WordPress has XSS.CVE-2016-10898 · WordPress plugins & themes · reported by MITREMedium 6.1
The total-security plugin before 3.4.1 for WordPress has XSS.
Product
total-security
Fixed in
3.4.1
What to do
Update total-security to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.CVE-2016-10897 · WordPress plugins & themes · reported by MITREMedium 6.1
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
Product
sermon-browser
Fixed in
0.45.16
What to do
Update sermon-browser to 0.45.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The seo-redirection plugin before 4.3 for WordPress has stored XSS.CVE-2016-10896 · WordPress plugins & themes · reported by MITREMedium 6.1
The seo-redirection plugin before 4.3 for WordPress has stored XSS.
Product
seo-redirection
Fixed in
4.3
What to do
Update seo-redirection to 4.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.CVE-2015-9321 · WordPress plugins & themes · reported by MITREMedium 6.1
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Product
shortcode-factory
Fixed in
1.1.1
What to do
Update shortcode-factory to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.4.7 for WordPress has XSS.CVE-2018-20978 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.7
What to do
Update wp-all-import to 3.4.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.CVE-2017-18566 · WordPress plugins & themes · reported by MITREMedium 6.1
The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
Product
user-role
Fixed in
1.5.6
What to do
Update user-role to 1.5.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.CVE-2017-18533 · WordPress plugins & themes · reported by MITREMedium 6.1
The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
Product
rimons-twitter-widget
Fixed in
1.3
What to do
Update rimons-twitter-widget to 1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The realty plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18532 · WordPress plugins & themes · reported by MITREMedium 6.1
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
realty
Fixed in
1.1.0
What to do
Update realty to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.CVE-2017-18531 · WordPress plugins & themes · reported by MITREMedium 6.1
The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
Product
raygun4wp
Fixed in
1.8.3
What to do
Update raygun4wp to 1.8.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.CVE-2017-18530 · WordPress plugins & themes · reported by MITREMedium 6.1
The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
Product
rating-bws
Fixed in
0.2
What to do
Update rating-bws to 0.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.CVE-2017-18529 · WordPress plugins & themes · reported by MITREMedium 6.1
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
Product
promobar
Fixed in
1.1.1
What to do
Update promobar to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.CVE-2017-18528 · WordPress plugins & themes · reported by MITREMedium 6.1
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
Product
pdf-print
Fixed in
1.9.4
What to do
Update pdf-print to 1.9.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.CVE-2017-18527 · WordPress plugins & themes · reported by MITREMedium 6.1
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
Product
pagination
Fixed in
1.0.7
What to do
Update pagination to 1.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The moreads-se plugin before 1.4.7 for WordPress has XSS.CVE-2017-18526 · WordPress plugins & themes · reported by MITREMedium 6.1
The moreads-se plugin before 1.4.7 for WordPress has XSS.
Product
moreads-se
Fixed in
1.4.7
What to do
Update moreads-se to 1.4.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.CVE-2017-18524 · WordPress plugins & themes · reported by MITREMedium 6.1
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
Product
football-pool
Fixed in
2.6.5
What to do
Update football-pool to 2.6.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.CVE-2017-18523 · WordPress plugins & themes · reported by MITREHigh 8.8
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
Product
eelv-newsletter
Fixed in
4.6.1
What to do
Update eelv-newsletter to 4.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.CVE-2017-18522 · WordPress plugins & themes · reported by MITREMedium 6.1
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
Product
eelv-newsletter
Fixed in
4.6.1
What to do
Update eelv-newsletter to 4.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.CVE-2017-18519 · WordPress plugins & themes · reported by MITREMedium 6.1
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
Product
customer-area
Fixed in
7.4.3
What to do
Update customer-area to 7.4.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18518 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
bws-smtp
Fixed in
1.1.0
What to do
Update bws-smtp to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.CVE-2016-10895 · WordPress plugins & themes · reported by MITREMedium 6.1
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
Product
option-tree
Fixed in
2.6.0
What to do
Update option-tree to 2.6.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.CVE-2016-10892 · WordPress plugins & themes · reported by MITREMedium 6.1
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
Product
chained-quiz
Fixed in
1.0
What to do
Update chained-quiz to 1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.