Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

5,867 results · page 91 of 118

Mar 21, 2019The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.CVE-2019-9912 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.
Product
wp-google-maps
Fixed in
7.10.43
What to do
Update wp-google-maps to 7.10.43 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Mar 21, 2019The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.CVE-2019-9911 · WordPress plugins & themes · reported by MITREMedium 6.1
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.
Product
social-networks-auto-poster-facebook-twitter-g
Fixed in
4.2.8
What to do
Update social-networks-auto-poster-facebook-twitter-g to 4.2.8 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Mar 21, 2019The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.CVE-2019-9910 · WordPress plugins & themes · reported by MITREMedium 6.1
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.
Affected
2.7.6 to 2.7.6
What to do
Affects 2.7.6 to 2.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org lists.openwall.net
Mar 21, 2019The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.CVE-2019-9909 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.
Product
Donation Plugin and Fundraising Platform
Fixed in
2.3.1
What to do
Update Donation Plugin and Fundraising Platform to 2.3.1 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Mar 21, 2019The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.CVE-2019-9908 · WordPress plugins & themes · reported by MITREMedium 6.1
The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.
Affected
2.1.1 to 2.1.1
What to do
Affects 2.1.1 to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org lists.openwall.net
Mar 21, 2019cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such aCVE-2019-7441 · WordPress plugins & themes · reported by MITREMedium 6.5
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
Product
WooCommerce PayPal Checkout Payment Gateway
Affected
1.6.8 to 1.6.8
What to do
Affects 1.6.8 to 1.6.8. Update WooCommerce PayPal Checkout Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com gkaim.com
Mar 21, 2019A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allCVE-2019-7299 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the subject parameter in wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/ajax/submit_ticket.php.
Product
WP Support Plus Responsive Ticket System
Affected
9.1.1 to 9.1.1
What to do
Affects 9.1.1 to 9.1.1. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.kalasag.com.ph wordpress.org
Mar 21, 2019The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key, CVE-2018-20555 · WordPress plugins & themes · reported by MITRECritical 9.8
The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key, and consumer_secret values by reading the dcwp_twitter.php source code. This leads to Twitter account takeover.
Affected
1.7.1 to 1.7.1
What to do
Affects 1.7.1 to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com twitter.com
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, whicCVE-2018-19488 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account.
Product
WP-jobhunt
Fixed in
2.4
What to do
Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.phpCVE-2018-19487 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.
Product
WP-jobhunt
Fixed in
2.4
What to do
Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Mar 14, 2019WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration.CVE-2019-9787 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.
Fixed in
5.1.1
What to do
Update the plugin to 5.1.1 or newer.
Full record and what to do →NVD record securityfocus.com blog.ripstech.com
Mar 10, 2019The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition areCVE-2019-9646 · WordPress plugins & themes · reported by MITREMedium 6.1
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."
Product
Contact Form Email
Fixed in
1.2.66
What to do
Update Contact Form Email to 1.2.66 or newer.
Full record and what to do →NVD record lists.openwall.net security-consulting.icu
Mar 5, 2019The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.CVE-2019-9576 · WordPress plugins & themes · reported by MITREMedium 6.1
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.
Product
Blog2Social
Fixed in
5.0.3
What to do
Update Blog2Social to 5.0.3 or newer.
Full record and what to do →NVD record lists.openwall.net security-consulting.icu
Mar 5, 2019The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.CVE-2019-9575 · WordPress plugins & themes · reported by MITREMedium 6.1
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.
Affected
6.0.4 to 6.0.4
What to do
Affects 6.0.4 to 6.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com lists.openwall.net
Mar 5, 2019The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR MaCVE-2019-9574 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role.
Product
WP Human Resource Management
Fixed in
2.2.6
What to do
Update WP Human Resource Management to 2.2.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 5, 2019The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.CVE-2019-9573 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.
Product
WP Human Resource Management
Fixed in
2.2.6
What to do
Update WP Human Resource Management to 2.2.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] CVE-2019-9568 · WordPress plugins & themes · reported by MITREMedium 6.5
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the attacker has the delete permission.
Product
Forminator Contact Form, Poll & Quiz Builder
Fixed in
1.6
What to do
Update Forminator Contact Form, Poll & Quiz Builder to 1.6 or newer.
Full record and what to do →NVD record lists.openwall.net security-consulting.icu
Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.CVE-2019-9567 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.
Product
Forminator Contact Form, Poll & Quiz Builder
Fixed in
1.6
What to do
Update Forminator Contact Form, Poll & Quiz Builder to 1.6 or newer.
Full record and what to do →NVD record lists.openwall.net security-consulting.icu
Feb 19, 2019WordPress through 5.0.3 allows Path Traversal in wp_crop_image().CVE-2019-8943 · WordPress plugins & themes · reported by MITREMedium 6.5
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Feb 19, 2019WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, sucCVE-2019-8942 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com rapid7.com
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating fCVE-2015-4617 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.
Affected
1.09 to 1.09
What to do
Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXMLCVE-2015-4615 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables
Affected
1.09 to 1.09
What to do
Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org wordpress.org
Feb 5, 2019In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text.CVE-2019-7413 · WordPress plugins & themes · reported by MITREMedium 6.1
In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. ("parallax" has a spelling change within the PHP filename.)
Product
In the Parallax Scroll (aka adamrob-parallax-scroll)
Fixed in
2.1
What to do
Update In the Parallax Scroll (aka adamrob-parallax-scroll) to 2.1 or newer.
Full record and what to do →NVD record metamorfosec.com plugins.trac.wordpress.org
Feb 5, 2019The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values.CVE-2019-7412 · WordPress plugins & themes · reported by MITRECritical 9.8
The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values.
Product
PS PHPCaptcha WP
Fixed in
1.2.0
What to do
Update PS PHPCaptcha WP to 1.2.0 or newer.
Full record and what to do →NVD record metamorfosec.com wordpress.org
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the diCVE-2018-19043 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mreloCVE-2018-19042 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.CVE-2018-19041 · WordPress plugins & themes · reported by MITREMedium 6.1
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2019The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to CVE-2018-19040 · WordPress plugins & themes · reported by MITREMedium 5.3
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
Affected
1.4.2 to 1.4.2
What to do
Affects 1.4.2 to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 26, 2019Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers CVE-2019-6703 · WordPress plugins & themes · reported by MITRECritical 9.8
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Product
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Jan 24, 2019The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrerCVE-2019-6780 · WordPress plugins & themes · reported by MITREMedium 6.1
The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer.
Product
Wise Chat
Fixed in
2.7
What to do
Update Wise Chat to 2.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 15, 2019In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at lCVE-2017-18356 · WordPress plugins & themes · reported by MITREHigh 8.8
In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection involving the includes/shortcodes/class-wc-shortcode-products.php WC_Shortcode_Products::get_products() use of cached queries within shortcodes.
Product
In the Automattic WooCommerce
Fixed in
3.2.4
What to do
Update In the Automattic WooCommerce to 3.2.4 or newer.
Full record and what to do →NVD record blog.ripstech.com woocommerce.wordpress.com
Jan 14, 2019The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templateCVE-2019-6267 · WordPress plugins & themes · reported by MITREMedium 6.1
The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI.
Affected
28.07-17 to 28.07-17
What to do
Affects 28.07-17 to 28.07-17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 12, 2019WordPress plugin spam-byebye 2.2.1 and earlier: Cross-site scriptingCVE-2018-16206 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WordPress plugin spam-byebye 2.2.1 and earlier
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WordPress plugin spam-byebye 2.2.1 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 9, 2019the LearnPress prior to version 3.1.0: SQL injectionCVE-2018-16175 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.2
SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
Product
the LearnPress prior to version 3.1.0
Fixed in
3.1.0
What to do
Update the LearnPress prior to version 3.1.0 to 3.1.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 9, 2019LearnPress prior to version 3.1.0: Open redirectCVE-2018-16174 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Product
LearnPress prior to version 3.1.0
Fixed in
3.1.0
What to do
Update LearnPress prior to version 3.1.0 to 3.1.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 9, 2019LearnPress prior to version 3.1.0: Cross-site scriptingCVE-2018-16173 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
LearnPress prior to version 3.1.0
Fixed in
3.1.0
What to do
Update LearnPress prior to version 3.1.0 to 3.1.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 9, 2019The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameCVE-2016-10736 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.
Product
Social Pug - Easy Social Share Buttons
Fixed in
1.2.6
What to do
Update Social Pug - Easy Social Share Buttons to 1.2.6 or newer.
Full record and what to do →NVD record advisories.dxw.com advisories.dxw.com
Dec 25, 2018An issue was discovered in the JSmol2WP plugin 1.07 for WordPress.CVE-2018-20463 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF.
Product
JSmol2WP
Affected
1.07 to 1.07
What to do
Affects 1.07 to 1.07. Update JSmol2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com cbiu.cc
Dec 25, 2018An issue was discovered in the JSmol2WP plugin 1.07 for WordPress.CVE-2018-20462 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter.
Product
JSmol2WP
Affected
1.07 to 1.07
What to do
Affects 1.07 to 1.07. Update JSmol2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com cbiu.cc
Dec 22, 2018The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.CVE-2018-20368 · WordPress plugins & themes · reported by MITREMedium 5.4
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Dec 20, 2018The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.CVE-2018-14846 · WordPress plugins & themes · reported by MITREMedium 5.4
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.
Product
Mondula Multi Step Form
Fixed in
1.2.8
What to do
Update Mondula Multi Step Form to 1.2.8 or newer.
Full record and what to do →NVD record ansawaf.blogspot.com cwatch.comodo.com
Dec 19, 2018Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_CVE-2018-20231 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.
Product
Cross Site Request Forgery (CSRF) in the two-factor-authentication
Fixed in
1.3.13
What to do
Update Cross Site Request Forgery (CSRF) in the two-factor-authentication to 1.3.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Dec 14, 2018The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multCVE-2018-20156 · WordPress plugins & themes · reported by MITREHigh 7.2
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network.
Product
WP Maintenance Mode
Fixed in
2.0.7
What to do
Update WP Maintenance Mode to 2.0.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 14, 2018The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugCVE-2018-20155 · WordPress plugins & themes · reported by MITREMedium 4.3
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.
Product
WP Maintenance Mode
Fixed in
2.0.7
What to do
Update WP Maintenance Mode to 2.0.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 14, 2018The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.CVE-2018-20154 · WordPress plugins & themes · reported by MITREMedium 4.3
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
Product
WP Maintenance Mode
Fixed in
2.0.7
What to do
Update WP Maintenance Mode to 2.0.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.CVE-2018-20153 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.CVE-2018-20152 · WordPress plugins & themes · reported by MITREMedium 6.5
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen.CVE-2018-20151 · WordPress plugins & themes · reported by MITREHigh 7.5
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.CVE-2018-20150 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictiCVE-2018-20149 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.