Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

446 results · page 9 of 9

Jan 28, 2020The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.CVE-2020-8417 · WordPress plugins & themes · reported by MITREHigh 8.8
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.
Product
Code Snippets
Fixed in
2.14.0
What to do
Update Code Snippets to 2.14.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script CVE-2014-4535 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
Product
Import Legacy Media
Affected
up to 0.1
What to do
Affects up to 0.1. Update Import Legacy Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Oct 7, 2019Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.CVE-2019-17233 · WordPress plugins & themes · reported by MITREMedium 6.1
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
Product
Functions/EWD_UFAQ_Import.php in the ultimate-faqs
Affected
up to 1.8.24
What to do
Affects up to 1.8.24. Update Functions/EWD_UFAQ_Import.php in the ultimate-faqs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Oct 7, 2019Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.CVE-2019-17232 · WordPress plugins & themes · reported by MITREHigh 7.5
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
Product
Functions/EWD_UFAQ_Import.php in the ultimate-faqs
Affected
up to 1.8.24
What to do
Affects up to 1.8.24. Update Functions/EWD_UFAQ_Import.php in the ultimate-faqs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-15872 · WordPress plugins & themes · reported by MITRECritical 9.8
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Sep 3, 2019The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.CVE-2019-15866 · WordPress plugins & themes · reported by MITREHigh 8.8
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.
Product
crelly-slider
Fixed in
1.3.5
What to do
Update crelly-slider to 1.3.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Product
admin/includes/class.import.snippet.php in the "Woody ad snippets
Fixed in
2.2.5
What to do
Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Aug 30, 2019The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.CVE-2019-15821 · WordPress plugins & themes · reported by MITREHigh 7.5
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Product
bold-page-builder
Fixed in
2.3.2
What to do
Update bold-page-builder to 2.3.2 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15819 · WordPress plugins & themes · reported by MITRECritical 9.8
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Product
nd-restaurant-reservations
Fixed in
1.5
What to do
Update nd-restaurant-reservations to 1.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 23, 2019The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name,CVE-2019-15092 · WordPress plugins & themes · reported by MITREHigh 7.3
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.CVE-2019-15329 · WordPress plugins & themes · reported by MITREHigh 8.8
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.CVE-2019-15328 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-15327 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
Product
import-users-from-csv-with-meta
Fixed in
1.14.1.3
What to do
Update import-users-from-csv-with-meta to 1.14.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-15326 · WordPress plugins & themes · reported by MITREHigh 7.5
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
Product
import-users-from-csv-with-meta
Fixed in
1.14.2.1
What to do
Update import-users-from-csv-with-meta to 1.14.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The wp-all-import plugin before 3.4.7 for WordPress has XSS.CVE-2018-20978 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.7
What to do
Update wp-all-import to 3.4.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.4.6 for WordPress has XSS.CVE-2017-18567 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.6
What to do
Update wp-all-import to 3.4.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.CVE-2016-10914 · WordPress plugins & themes · reported by MITREHigh 8.8
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
Product
add-from-server
Fixed in
3.3.2
What to do
Update add-from-server to 3.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Product
wp-all-import
Fixed in
3.2.4
What to do
Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.CVE-2015-9330 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.CVE-2015-9329 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.CVE-2018-20967 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
Product
wp-ultimate-csv-importer
Fixed in
5.6.1
What to do
Update wp-ultimate-csv-importer to 5.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.CVE-2019-14948 · WordPress plugins & themes · reported by MITREMedium 5.4
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
Product
woocommerce-product-addon
Fixed in
18.4
What to do
Update woocommerce-product-addon to 18.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.CVE-2015-9306 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
Product
wp-ultimate-csv-importer
Fixed in
3.8.1
What to do
Update wp-ultimate-csv-importer to 3.8.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Product
codection "Import users from CSV with meta
Fixed in
1.14.2.2
What to do
Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 8, 2019core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.CVE-2019-14679 · WordPress plugins & themes · reported by MITREMedium 6.5
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
Product
ARPrice Lite
Affected
2.2 to 2.2
What to do
Affects 2.2 to 2.2. Update ARPrice Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16259 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16258 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template.CVE-2018-16257 · WordPress plugins & themes · reported by MITREMedium 6.1
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16256 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16255 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16254 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Dec 12, 2018The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.CVE-2018-20101 · WordPress plugins & themes · reported by MITREMedium 6.1
The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.
Product
codection "Import users from CSV with meta
Fixed in
1.12.1
What to do
Update codection "Import users from CSV with meta to 1.12.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Nov 28, 2018A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allowsCVE-2018-19370 · WordPress plugins & themes · reported by MITREMedium 6.6
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
Product
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo)
Fixed in
9.2.0
What to do
Update A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) to 9.2.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Jun 19, 2018The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.CVE-2018-11526 · WordPress plugins & themes · reported by MITREHigh 7.8
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 9, 2018WP All Import plugin prior to version 3.4.7 for: Cross-site scriptingCVE-2018-0547 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP All Import plugin prior to version 3.4.7 for
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update WP All Import plugin prior to version 3.4.7 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Mar 9, 2018WP All Import plugin prior to version 3.4.6 for: Cross-site scriptingCVE-2018-0546 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP All Import plugin prior to version 3.4.6 for
Fixed in
3.4.6
What to do
Update WP All Import plugin prior to version 3.4.6 for to 3.4.6 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Dec 27, 2017Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPreCVE-2015-7669 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to "upload file functionality."
Fixed in
1.3.0
What to do
Update the plugin to 1.3.0 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Dec 19, 2017Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary webCVE-2017-17753 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cie_type, (2) cie_import, (3) cie_update, or (4) cie_ignore parameter to includes/admin/views/esb-cie-import-export-page.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export
Affected
up to 1.1
What to do
Affects up to 1.1. Update Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
Aug 18, 2015Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 forCVE-2015-5485 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php.
Fixed in
3.10.2
What to do
Update the plugin to 3.10.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 31, 2013zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4: SQL injectionCVE-2013-7242 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter.
Product
zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4
Fixed in
1.4.5.4
What to do
Update zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 to 1.4.5.4 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Apr 2, 2013importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which caCVE-2013-2744 · WordPress plugins & themes · reported by MITREMedium 5
importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.
Product
BackupBuddy
What to do
Update BackupBuddy to the newest version.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Apr 2, 2013importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted iCVE-2013-2743 · WordPress plugins & themes · reported by MITREHigh 7.5
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Apr 2, 2013importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operaCVE-2013-2742 · WordPress plugins & themes · reported by MITREHigh 7.5
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Apr 2, 2013importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows reCVE-2013-2741 · WordPress plugins & themes · reported by MITREHigh 7.5
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Mar 28, 2007an mt import in wp-admin/admin.php in WordPress 2.1.2: Cross-site scripting (XSS)CVE-2007-1732 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor
Product
an mt import in wp-admin/admin.php in WordPress 2.1.2
What to do
Update an mt import in wp-admin/admin.php in WordPress 2.1.2 to the newest version.
Full record and what to do →NVD record codex.wordpress.org marc.info

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.