Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

5,867 results · page 89 of 118

Aug 9, 2019The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.CVE-2019-14791 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
Affected
1.3.18 to 1.3.18
What to do
Affects 1.3.18 to 1.3.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.CVE-2019-14799 · WordPress plugins & themes · reported by MITREMedium 6.1
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
Product
FV Flowplayer Video Player
Fixed in
7.3.14.727
What to do
Update FV Flowplayer Video Player to 7.3.14.727 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.CVE-2019-14793 · WordPress plugins & themes · reported by MITREMedium 6.5
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
Product
Meta Box
Fixed in
4.16.3
What to do
Update Meta Box to 4.16.3 or newer.
Full record and what to do →NVD record metabox.io pluginvulnerabilities.com
Aug 9, 2019The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.CVE-2019-14792 · WordPress plugins & themes · reported by MITREMedium 5.4
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
Product
WP Google Maps
Fixed in
7.11.35
What to do
Update WP Google Maps to 7.11.35 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameterCVE-2019-14787 · WordPress plugins & themes · reported by MITREMedium 5.4
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
Product
Tribulant Newsletters
Fixed in
4.6.19
What to do
Update Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.phpCVE-2019-14785 · WordPress plugins & themes · reported by MITREMedium 5.4
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
Product
CP Contact Form with PayPal
Fixed in
1.2.99
What to do
Update CP Contact Form with PayPal to 1.2.99 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 9, 2019The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated byCVE-2016-10865 · WordPress plugins & themes · reported by MITREMedium 6.1
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
Product
Lightbox Plus Colorbox
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Lightbox Plus Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatcheCVE-2019-14774 · WordPress plugins & themes · reported by MITREMedium 6.1
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
Affected
1.0.61 to 1.0.61
What to do
Affects 1.0.61 to 1.0.61. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Aug 8, 2019admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletioCVE-2019-14773 · WordPress plugins & themes · reported by MITREHigh 7.5
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
Product
admin/includes/class.actions.snippet.php in the "Woody ad snippets
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update admin/includes/class.actions.snippet.php in the "Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Product
codection "Import users from CSV with meta
Fixed in
1.14.2.2
What to do
Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 8, 2019The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.CVE-2019-14682 · WordPress plugins & themes · reported by MITREMedium 4.3
The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
Product
acf-better-search (aka ACF: Better Search)
Fixed in
3.3.1
What to do
Update acf-better-search (aka ACF: Better Search) to 3.3.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 8, 2019The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.CVE-2019-14681 · WordPress plugins & themes · reported by MITREHigh 8.8
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
Product
Deny All Firewall
Fixed in
1.1.7
What to do
Update Deny All Firewall to 1.1.7 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.CVE-2019-14680 · WordPress plugins & themes · reported by MITREMedium 5.7
The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
Affected
3.2.1 to 3.2.1
What to do
Affects 3.2.1 to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Aug 8, 2019core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.CVE-2019-14679 · WordPress plugins & themes · reported by MITREMedium 6.5
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
Product
ARPrice Lite
Affected
2.2 to 2.2
What to do
Affects 2.2 to 2.2. Update ARPrice Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 6, 2019A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress.CVE-2019-14695 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is mishandled.
Product
A SQL injection vulnerability exists in the Sygnoos Popup Builder
Fixed in
3.45
What to do
Update A SQL injection vulnerability exists in the Sygnoos Popup Builder to 3.45 or newer.
Full record and what to do →NVD record fortiguard.com wordpress.org
Aug 5, 2019The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?actioCVE-2019-14348 · WordPress plugins & themes · reported by MITRECritical 9.8
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter.
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
Aug 1, 2019The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection.CVE-2019-13572 · WordPress plugins & themes · reported by MITRECritical 9.8
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection.
Product
Adenion Blog2Social
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Adenion Blog2Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com plugins.trac.wordpress.org
Jul 30, 2019A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress.CVE-2019-14313 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.
Product
A SQL injection vulnerability exists in the 10Web Photo Gallery
Fixed in
1.5.31
What to do
Update A SQL injection vulnerability exists in the 10Web Photo Gallery to 1.5.31 or newer.
Full record and what to do →NVD record fortiguard.com plugins.trac.wordpress.org
Jul 30, 2019A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.CVE-2019-14327 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
Product
Custom Simple Rss
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Custom Simple Rss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 30, 2019The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.CVE-2019-13635 · WordPress plugins & themes · reported by MITRECritical 9.1
The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.
Product
WP Fastest Cache
Affected
up to 0.8.9.5
What to do
Affects up to 0.8.9.5. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jul 29, 2019A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress.CVE-2019-13571 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
Product
A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Jul 29, 2019The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_foCVE-2019-6726 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header.
Product
WP Fastest Cache
Affected
up to 0.8.9.0
What to do
Affects up to 0.8.9.0. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jul 28, 2019An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicCVE-2019-14364 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.
Product
Email Subscribers & Newsletters
Affected
4.1.6 to 4.1.6
What to do
Affects 4.1.6 to 4.1.6. Update Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 28, 2019The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.CVE-2019-14328 · WordPress plugins & themes · reported by MITREHigh 8.8
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
Product
Simple Membership
Fixed in
3.8.5
What to do
Update Simple Membership to 3.8.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Jul 23, 2019The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.CVE-2019-13570 · WordPress plugins & themes · reported by MITREHigh 7.2
The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.
Product
AJdG AdRotate
Fixed in
5.3
What to do
Update AJdG AdRotate to 5.3 or newer.
Full record and what to do →NVD record ajdg.solutions wpvulndb.com
Jul 23, 2019GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434.CVE-2019-1010209 · WordPress plugins & themes · reported by josh@bress.netHigh 7.5
GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L5637. The fixed version is: 1.4.14.
Affected
up to 1.4.13
What to do
Affects up to 1.4.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com github.com
Jul 21, 2019An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress.CVE-2019-14231 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.
Product
An issue was discovered in the Viral Quiz Maker - OnionBuzz
Fixed in
1.2.2
What to do
Update An issue was discovered in the Viral Quiz Maker - OnionBuzz to 1.2.2 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Jul 21, 2019An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress.CVE-2019-14230 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.
Product
An issue was discovered in the Viral Quiz Maker - OnionBuzz
Fixed in
1.2.7
What to do
Update An issue was discovered in the Viral Quiz Maker - OnionBuzz to 1.2.7 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Jul 21, 2019An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via tCVE-2019-14206 · WordPress plugins & themes · reported by MITREHigh 7.5
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php.
Product
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images
Fixed in
0.6.67
What to do
Update An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images to 0.6.67 or newer.
Full record and what to do →NVD record github.com markgruffer.github.io
Jul 21, 2019A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via theCVE-2019-14205 · WordPress plugins & themes · reported by MITREHigh 7.5
A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.
Product
A Local File Inclusion vulnerability in the Nevma Adaptive Images
Fixed in
0.6.67
What to do
Update A Local File Inclusion vulnerability in the Nevma Adaptive Images to 0.6.67 or newer.
Full record and what to do →NVD record github.com markgruffer.github.io
Jul 19, 2019An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress.CVE-2019-12934 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
Product
An issue was discovered in the wp-code-highlightjs
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update An issue was discovered in the wp-code-highlightjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com wordpress.org
Jul 19, 2019A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress.CVE-2019-13569 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
Product
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 18, 2019TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection.CVE-2019-1010104 · WordPress plugins & themes · reported by josh@bress.netCritical 9.8
TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: like_escape is used in Quick-chat.php line 399. The attack vector is: Crafted ajax request.
Affected
up to 4.14
What to do
Affects up to 4.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record metalamin.github.io metalamin.github.io
Jul 18, 2019A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9.CVE-2019-13575 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Jul 18, 2019The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.CVE-2016-10763 · WordPress plugins & themes · reported by MITREMedium 4.8
The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.
Product
CampTix Event Ticketing
Fixed in
1.5
What to do
Update CampTix Event Ticketing to 1.5 or newer.
Full record and what to do →NVD record hackerone.com wordpress.org
Jul 18, 2019The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.CVE-2016-10762 · WordPress plugins & themes · reported by MITREHigh 7.5
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.
Product
CampTix Event Ticketing
Fixed in
1.5
What to do
Update CampTix Event Ticketing to 1.5 or newer.
Full record and what to do →NVD record hackerone.com wordpress.org
Jul 17, 2019A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress.CVE-2019-13573 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
Product
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player
Fixed in
7.3.19.727
What to do
Update A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player to 7.3.19.727 or newer.
Full record and what to do →NVD record fortiguard.com plugins.trac.wordpress.org
Jul 11, 2019The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.CVE-2019-13505 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
Affected
1.1.44 to 1.1.44
What to do
Affects 1.1.44 to 1.1.44. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 9, 2019The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.CVE-2019-13478 · WordPress plugins & themes · reported by MITRECritical 9.8
The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.
Product
Yoast SEO
Fixed in
11.6-RC5
What to do
Update Yoast SEO to 11.6-RC5 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Jul 8, 2019The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.CVE-2019-13414 · WordPress plugins & themes · reported by MITREMedium 6.1
The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.
Product
Rencontre
Fixed in
3.1.3
What to do
Update Rencontre to 3.1.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 8, 2019The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.CVE-2019-13413 · WordPress plugins & themes · reported by MITRECritical 9.8
The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.
Product
Rencontre
Fixed in
3.1.3
What to do
Update Rencontre to 3.1.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 5, 2019An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings.CVE-2019-13344 · WordPress plugins & themes · reported by MITREMedium 5.3
An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter.
Product
An authentication bypass vulnerability in the CRUDLab WP Like Button
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update An authentication bypass vulnerability in the CRUDLab WP Like Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com limbenjamin.com
Jul 4, 2019An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress.CVE-2019-13275 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.
Product
An issue was discovered in the VeronaLabs wp-statistics
Fixed in
12.6.7
What to do
Update An issue was discovered in the VeronaLabs wp-statistics to 12.6.7 or newer.
Full record and what to do →NVD record github.com wordpress.org
Jul 3, 2019A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQCVE-2019-12570 · WordPress plugins & themes · reported by MITREHigh 8.8
A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters.
Product
Xpert Solution "Server Status by Hostname/IP
Affected
4.6 to 4.6
What to do
Affects 4.6 to 4.6. Update Xpert Solution "Server Status by Hostname/IP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jul 1, 2019A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers toCVE-2019-12826 · WordPress plugins & themes · reported by MITREHigh 8.8
A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to dynamically determine their visibility) by crafting a malicious POST request that tricks administrators into adding the code.
Product
A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic
Fixed in
5.10.2
What to do
Update A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic to 5.10.2 or newer.
Full record and what to do →NVD record dannewitz.ninja plugins.trac.wordpress.org
Jun 24, 2019In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XCVE-2019-12346 · WordPress plugins & themes · reported by MITREMedium 6.1
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.
Product
In the miniOrange SAML SP Single Sign On
Fixed in
4.8.73
What to do
Update In the miniOrange SAML SP Single Sign On to 4.8.73 or newer.
Full record and what to do →NVD record wpvulndb.com zeroauth.ltd
Jun 24, 2019An issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10271 · WordPress plugins & themes · reported by MITREMedium 4.3
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.
Product
Ultimate Member
Fixed in
2.0.40
What to do
Update Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jun 21, 2019An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10270 · WordPress plugins & themes · reported by MITREHigh 8.8
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation.
Product
Ultimate Member
Fixed in
2.0.40
What to do
Update Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jun 19, 2019An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress.CVE-2018-16613 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction.
Product
An issue was discovered in the update function in the wpForo Forum
Fixed in
1.5.2
What to do
Update An issue was discovered in the update function in the wpForo Forum to 1.5.2 or newer.
Full record and what to do →NVD record github.com github.com
Jun 15, 2019The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.CVE-2013-7472 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
Product
Count per Day
Fixed in
3.2.6
What to do
Update Count per Day to 3.2.6 or newer.
Full record and what to do →NVD record lists.openwall.net wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.