Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 45 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
33added in the last 30 days
531new WordPress flaws this week
391,883entries in the database

5,867 results · page 88 of 118

  • Aug 13, 2019The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.CVE-2016-10871 · WordPress plugins & themes · reported by MITREMedium 6.1

    The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.

    Product
    mailchimp-for-wp
    Fixed in
    4.0.11
    What to do
    Update mailchimp-for-wp to 4.0.11 or newer.
  • Aug 13, 2019The google-language-translator plugin before 5.0.06 for WordPress has XSS.CVE-2016-10870 · WordPress plugins & themes · reported by MITREMedium 6.1

    The google-language-translator plugin before 5.0.06 for WordPress has XSS.

    Product
    google-language-translator
    Fixed in
    5.0.06
    What to do
    Update google-language-translator to 5.0.06 or newer.
  • Aug 13, 2019The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.CVE-2016-10869 · WordPress plugins & themes · reported by MITREMedium 6.1

    The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.

    Product
    contact-form-plugin
    Fixed in
    4.0.2
    What to do
    Update contact-form-plugin to 4.0.2 or newer.
  • Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.CVE-2016-10868 · WordPress plugins & themes · reported by MITREMedium 6.1

    The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.

    Product
    all-in-one-wp-security-and-firewall
    Fixed in
    4.0.5
    What to do
    Update all-in-one-wp-security-and-firewall to 4.0.5 or newer.
  • Aug 13, 2019The simple-fields plugin before 1.4.11 for WordPress has XSS.CVE-2015-9302 · WordPress plugins & themes · reported by MITREMedium 6.1

    The simple-fields plugin before 1.4.11 for WordPress has XSS.

    Product
    simple-fields
    Fixed in
    1.4.11
    What to do
    Update simple-fields to 1.4.11 or newer.
  • Aug 13, 2019The liveforms plugin before 3.2.0 for WordPress has SQL injection.CVE-2015-9301 · WordPress plugins & themes · reported by MITRECritical 9.8

    The liveforms plugin before 3.2.0 for WordPress has SQL injection.

    Product
    liveforms
    Fixed in
    3.2.0
    What to do
    Update liveforms to 3.2.0 or newer.
  • Aug 13, 2019The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.CVE-2015-9300 · WordPress plugins & themes · reported by MITREMedium 6.1

    The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.

    Product
    events-manager
    Fixed in
    5.5.7
    What to do
    Update events-manager to 5.5.7 or newer.
  • Aug 13, 2019The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.CVE-2015-9299 · WordPress plugins & themes · reported by MITREMedium 6.1

    The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.

    Product
    events-manager
    Fixed in
    5.5.7.1
    What to do
    Update events-manager to 5.5.7.1 or newer.
  • Aug 13, 2019The events-manager plugin before 5.6 for WordPress has code injection.CVE-2015-9298 · WordPress plugins & themes · reported by MITRECritical 9.8

    The events-manager plugin before 5.6 for WordPress has code injection.

    Product
    events-manager
    Fixed in
    5.6
    What to do
    Update events-manager to 5.6 or newer.
  • Aug 13, 2019The events-manager plugin before 5.6 for WordPress has XSS.CVE-2015-9297 · WordPress plugins & themes · reported by MITREMedium 6.1

    The events-manager plugin before 5.6 for WordPress has XSS.

    Product
    events-manager
    Fixed in
    5.6
    What to do
    Update events-manager to 5.6 or newer.
  • Aug 13, 2019The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.CVE-2015-9296 · WordPress plugins & themes · reported by MITREMedium 6.1

    The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.

    Product
    download-monitor
    Fixed in
    1.7.1
    What to do
    Update download-monitor to 1.7.1 or newer.
  • Aug 13, 2019The contact-form-plugin plugin before 3.96 for WordPress has XSS.CVE-2015-9295 · WordPress plugins & themes · reported by MITREMedium 6.1

    The contact-form-plugin plugin before 3.96 for WordPress has XSS.

    Product
    contact-form-plugin
    Fixed in
    3.96
    What to do
    Update contact-form-plugin to 3.96 or newer.
  • Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.CVE-2015-9294 · WordPress plugins & themes · reported by MITREMedium 6.1

    The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.

    Product
    all-in-one-wp-security-and-firewall
    Fixed in
    3.9.5
    What to do
    Update all-in-one-wp-security-and-firewall to 3.9.5 or newer.
  • Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.CVE-2015-9293 · WordPress plugins & themes · reported by MITREMedium 6.1

    The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.

    Product
    all-in-one-wp-security-and-firewall
    Fixed in
    3.9.8
    What to do
    Update all-in-one-wp-security-and-firewall to 3.9.8 or newer.
  • Aug 13, 2019The contact-form-plugin plugin before 3.52 for WordPress has XSS.CVE-2013-7475 · WordPress plugins & themes · reported by MITREMedium 6.1

    The contact-form-plugin plugin before 3.52 for WordPress has XSS.

    Product
    contact-form-plugin
    Fixed in
    3.52
    What to do
    Update contact-form-plugin to 3.52 or newer.
  • Aug 13, 2019The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.CVE-2012-6713 · WordPress plugins & themes · reported by MITREMedium 6.1

    The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.

    Product
    job-manager
    Fixed in
    0.7.19
    What to do
    Update job-manager to 0.7.19 or newer.
  • Aug 12, 2019The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.CVE-2019-14947 · WordPress plugins & themes · reported by MITREMedium 5.4

    The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.

    Product
    ultimate-member
    Fixed in
    2.0.52
    What to do
    Update ultimate-member to 2.0.52 or newer.
  • Aug 12, 2019The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.CVE-2019-14946 · WordPress plugins & themes · reported by MITREMedium 5.4

    The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.

    Product
    ultimate-member
    Fixed in
    2.0.52
    What to do
    Update ultimate-member to 2.0.52 or newer.
  • Aug 12, 2019The ultimate-member plugin before 2.0.54 for WordPress has XSS.CVE-2019-14945 · WordPress plugins & themes · reported by MITREMedium 5.4

    The ultimate-member plugin before 2.0.54 for WordPress has XSS.

    Product
    ultimate-member
    Fixed in
    2.0.54
    What to do
    Update ultimate-member to 2.0.54 or newer.
  • Aug 12, 2019The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.CVE-2018-20966 · WordPress plugins & themes · reported by MITREMedium 6.1

    The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.

    Product
    woocommerce-jetpack
    Fixed in
    3.8.0
    What to do
    Update woocommerce-jetpack to 3.8.0 or newer.
  • Aug 12, 2019The ultimate-member plugin before 2.0.4 for WordPress has XSS.CVE-2018-20965 · WordPress plugins & themes · reported by MITREMedium 6.1

    The ultimate-member plugin before 2.0.4 for WordPress has XSS.

    Product
    ultimate-member
    Fixed in
    2.0.4
    What to do
    Update ultimate-member to 2.0.4 or newer.
  • Aug 12, 2019The twitter-plugin plugin before 2.55 for WordPress has XSS.CVE-2017-18505 · WordPress plugins & themes · reported by MITREMedium 6.1

    The twitter-plugin plugin before 2.55 for WordPress has XSS.

    Product
    twitter-plugin
    Fixed in
    2.55
    What to do
    Update twitter-plugin to 2.55 or newer.
  • Aug 12, 2019The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.CVE-2017-18504 · WordPress plugins & themes · reported by MITREHigh 8.8

    The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.

    Product
    twitter-cards-meta
    Fixed in
    2.5.0
    What to do
    Update twitter-cards-meta to 2.5.0 or newer.
  • Aug 12, 2019The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.CVE-2017-18503 · WordPress plugins & themes · reported by MITREMedium 6.1

    The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.

    Product
    twitter-cards-meta
    Fixed in
    2.5.0
    What to do
    Update twitter-cards-meta to 2.5.0 or newer.
  • Aug 12, 2019The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.CVE-2017-18502 · WordPress plugins & themes · reported by MITREMedium 6.1

    The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.

    Product
    subscriber
    Fixed in
    1.3.5
    What to do
    Update subscriber to 1.3.5 or newer.
  • Aug 12, 2019The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.CVE-2017-18501 · WordPress plugins & themes · reported by MITREMedium 6.1

    The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.

    Product
    social-login-bws
    Fixed in
    0.2
    What to do
    Update social-login-bws to 0.2 or newer.
  • Aug 12, 2019The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.CVE-2017-18500 · WordPress plugins & themes · reported by MITREMedium 6.1

    The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.

    Product
    social-buttons-pack
    Fixed in
    1.1.1
    What to do
    Update social-buttons-pack to 1.1.1 or newer.
  • Aug 12, 2019The simple-membership plugin before 3.5.7 for WordPress has XSS.CVE-2017-18499 · WordPress plugins & themes · reported by MITREMedium 6.1

    The simple-membership plugin before 3.5.7 for WordPress has XSS.

    Product
    simple-membership
    Fixed in
    3.5.7
    What to do
    Update simple-membership to 3.5.7 or newer.
  • Aug 12, 2019The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.CVE-2016-10872 · WordPress plugins & themes · reported by MITREMedium 6.1

    The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.

    Product
    ultimate-member
    Fixed in
    1.3.40
    What to do
    Update ultimate-member to 1.3.40 or newer.
  • Aug 12, 2019The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.CVE-2015-9304 · WordPress plugins & themes · reported by MITREMedium 6.1

    The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

    Product
    ultimate-member
    Fixed in
    1.3.18
    What to do
    Update ultimate-member to 1.3.18 or newer.
  • Aug 12, 2019The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.CVE-2015-9303 · WordPress plugins & themes · reported by MITREMedium 6.1

    The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.

    Product
    simple-share-buttons-adder
    Fixed in
    6.0.0
    What to do
    Update simple-share-buttons-adder to 6.0.0 or newer.
  • Aug 12, 2019The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.CVE-2019-14950 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

    Product
    wp-live-chat-support
    Fixed in
    8.0.27
    What to do
    Update wp-live-chat-support to 8.0.27 or newer.
  • Aug 12, 2019The wp-database-backup plugin before 5.1.2 for WordPress has XSS.CVE-2019-14949 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-database-backup plugin before 5.1.2 for WordPress has XSS.

    Product
    wp-database-backup
    Fixed in
    5.1.2
    What to do
    Update wp-database-backup to 5.1.2 or newer.
  • Aug 12, 2019The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.CVE-2019-14948 · WordPress plugins & themes · reported by MITREMedium 5.4

    The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.

    Product
    woocommerce-product-addon
    Fixed in
    18.4
    What to do
    Update woocommerce-product-addon to 18.4 or newer.
  • Aug 12, 2019The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.CVE-2017-18508 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.

    Product
    wp-live-chat-support
    Fixed in
    7.1.03
    What to do
    Update wp-live-chat-support to 7.1.03 or newer.
  • Aug 12, 2019The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.CVE-2017-18506 · WordPress plugins & themes · reported by MITREMedium 6.1

    The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.

    Product
    woocommerce-pdf-invoices-packing-slips
    Fixed in
    2.0.13
    What to do
    Update woocommerce-pdf-invoices-packing-slips to 2.0.13 or newer.
  • Aug 12, 2019The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.CVE-2016-10879 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.

    Product
    wp-live-chat-support
    Fixed in
    6.2.02
    What to do
    Update wp-live-chat-support to 6.2.02 or newer.
  • Aug 12, 2019The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.CVE-2016-10878 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.

    Product
    wp-google-map-plugin
    Fixed in
    3.1.2
    What to do
    Update wp-google-map-plugin to 3.1.2 or newer.
  • Aug 12, 2019The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.CVE-2016-10877 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.

    Product
    wp-editor
    Fixed in
    1.2.6.3
    What to do
    Update wp-editor to 1.2.6.3 or newer.
  • Aug 12, 2019The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.CVE-2016-10876 · WordPress plugins & themes · reported by MITREHigh 8.8

    The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

    Product
    wp-database-backup
    Fixed in
    4.3.1
    What to do
    Update wp-database-backup to 4.3.1 or newer.
  • Aug 12, 2019The wp-database-backup plugin before 4.3.1 for WordPress has XSS.CVE-2016-10875 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-database-backup plugin before 4.3.1 for WordPress has XSS.

    Product
    wp-database-backup
    Fixed in
    4.3.1
    What to do
    Update wp-database-backup to 4.3.1 or newer.
  • Aug 12, 2019The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.CVE-2016-10874 · WordPress plugins & themes · reported by MITREHigh 8.8

    The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.

    Product
    wp-database-backup
    Fixed in
    4.3.3
    What to do
    Update wp-database-backup to 4.3.3 or newer.
  • Aug 12, 2019The wp-database-backup plugin before 4.3.3 for WordPress has XSS.CVE-2016-10873 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-database-backup plugin before 4.3.3 for WordPress has XSS.

    Product
    wp-database-backup
    Fixed in
    4.3.3
    What to do
    Update wp-database-backup to 4.3.3 or newer.
  • Aug 12, 2019The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.CVE-2015-9306 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.

    Product
    wp-ultimate-csv-importer
    Fixed in
    3.8.1
    What to do
    Update wp-ultimate-csv-importer to 3.8.1 or newer.
  • Aug 12, 2019The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.CVE-2015-9305 · WordPress plugins & themes · reported by MITREMedium 6.1

    The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.

    Product
    wp-google-map-plugin
    Fixed in
    2.3.7
    What to do
    Update wp-google-map-plugin to 2.3.7 or newer.
  • Aug 9, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.CVE-2019-14801 · WordPress plugins & themes · reported by MITRECritical 9.8

    The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.

    Product
    FV Flowplayer Video Player
    Fixed in
    7.3.15.727
    What to do
    Update FV Flowplayer Video Player to 7.3.15.727 or newer.
  • Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=CVE-2019-14798 · WordPress plugins & themes · reported by MITREMedium 4.9

    The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.

    Product
    10Web Photo Gallery
    Fixed in
    1.5.25
    What to do
    Update 10Web Photo Gallery to 1.5.25 or newer.
  • Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.CVE-2019-14797 · WordPress plugins & themes · reported by MITREMedium 5.4

    The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.

    Product
    10Web Photo Gallery
    Fixed in
    1.5.23
    What to do
    Update 10Web Photo Gallery to 1.5.23 or newer.
  • Aug 9, 2019The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?actioCVE-2019-14796 · WordPress plugins & themes · reported by MITREMedium 5.4

    The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.

    Affected
    2.0 to 2.0
    What to do
    Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 9, 2019The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.CVE-2019-14794 · WordPress plugins & themes · reported by MITREHigh 7.5

    The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.

    Product
    Meta Box
    Fixed in
    4.16.2
    What to do
    Update Meta Box to 4.16.2 or newer.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.