Vulnerability database

5,867 results · page 94 of 118

• Mar 19, 2018Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject CVE-2014-2297 · WordPress plugins & themes · reported by MITREMedium 6.1

  Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.

  Product

  VideoWhisper Live Streaming Integration

  Affected

  4.29.6 to 4.29.6

  What to do

  Affects 4.29.6 to 4.29.6. Update VideoWhisper Live Streaming Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com

• Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the aCVE-2014-2274 · WordPress plugins & themes · reported by MITREHigh 8.8

  Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php.

  Product

  Subscribe To Comments Reloaded

  Fixed in

  140219

  What to do

  Update Subscribe To Comments Reloaded to 140219 or newer.

  Full record and what to do →NVD recordsecurity.dxw.comwordpress.org

• Mar 19, 2018A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_pathCVE-2018-7422 · WordPress plugins & themes · reported by MITREHigh 7.5

  A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.

  Product

  A Local File Inclusion vulnerability in the Site Editor

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update A Local File Inclusion vulnerability in the Site Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordseclists.orgwpvulndb.com

• Mar 15, 2018Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript CVE-2018-8729 · WordPress plugins & themes · reported by MITREMedium 6.1

  Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.

  Product

  Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log

  Fixed in

  2.4.1

  What to do

  Update Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log to 2.4.1 or newer.

  Full record and what to do →NVD recordgithub.comgithub.com

• Mar 14, 2018A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode paCVE-2018-8711 · WordPress plugins & themes · reported by MITRECritical 9.8

  A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.

  Product

  A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF)

  Fixed in

  2.2.0

  What to do

  Update A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.

  Full record and what to do →NVD recordsec-consult.comwordpress.org

• Mar 14, 2018A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode pCVE-2018-8710 · WordPress plugins & themes · reported by MITRECritical 9.8

  A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.

  Product

  A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF)

  Fixed in

  2.2.0

  What to do

  Update A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.

  Full record and what to do →NVD recordsec-consult.comwordpress.org

• Mar 14, 2018the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter: Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL InjCVE-2018-1000131 · WordPress plugins & themes · reported by MITRECritical 9.8

  Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later.

  Product

  the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter

  Affected

  up to 9.0.2

  Fixed in

  9.0.3

  What to do

  Update the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter to 9.0.3 or newer.

  Full record and what to do →NVD recordgithub.comwordpress.org

• Mar 7, 2018inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt.CVE-2018-7204 · WordPress plugins & themes · reported by MITREHigh 7.5

  inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and contains database credentials, salts, etc. These files have been indexed by Google and a simple dork will find affected sites.

  Product

  inc/logger.php in the Giribaz File Manager

  Fixed in

  5.0.2

  What to do

  Update inc/logger.php in the Giribaz File Manager to 5.0.2 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Mar 2, 2018The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.CVE-2018-7433 · WordPress plugins & themes · reported by MITREHigh 7.5

  The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.

  Product

  iThemes Security

  Fixed in

  6.9.1

  What to do

  Update iThemes Security to 6.9.1 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Mar 1, 2018In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.CVE-2018-7586 · WordPress plugins & themes · reported by MITREHigh 7.5

  In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.

  Product

  In the nextgen-gallery

  Fixed in

  2.2.50

  What to do

  Update In the nextgen-gallery to 2.2.50 or newer.

  Full record and what to do →NVD recordwordpress.orgwpvulndb.com

• Feb 21, 2018The Ninja Forms plugin before 3.2.14 for WordPress has XSS.CVE-2018-7280 · WordPress plugins & themes · reported by MITREMedium 6.1

  The Ninja Forms plugin before 3.2.14 for WordPress has XSS.

  Product

  Ninja Forms

  Fixed in

  3.2.14

  What to do

  Update Ninja Forms to 3.2.14 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Feb 19, 2018Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit CVE-2015-2324 · WordPress plugins & themes · reported by MITREMedium 5.4

  Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors.

  Product

  Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery

  Fixed in

  1.2.13

  What to do

  Update Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery to 1.2.13 or newer.

  Full record and what to do →NVD recordfortiguard.comgithub.com

• Feb 16, 2018core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitizeCVE-2018-6944 · WordPress plugins & themes · reported by MITREMedium 6.1

  core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.

  Product

  UltimateMember

  Affected

  2.0 to 2.0

  What to do

  Affects 2.0 to 2.0. Update UltimateMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com

• Feb 16, 2018core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitizCVE-2018-6943 · WordPress plugins & themes · reported by MITREMedium 6.1

  core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.

  Product

  UltimateMember

  Affected

  2.0 to 2.0

  What to do

  Affects 2.0 to 2.0. Update UltimateMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com

• Feb 11, 2018Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.CVE-2018-6891 · WordPress plugins & themes · reported by MITREMedium 6.1

  Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.

  Fixed in

  14.5

  What to do

  Update the plugin to 14.5 or newer.

  Full record and what to do →NVD recordwordpress.orggubello.me

• Feb 8, 2018Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2015-2329 · WordPress plugins & themes · reported by MITREMedium 6.1

  Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.

  Product

  Cross-site scripting (XSS) vulnerability in the WooCommerce

  Fixed in

  2.3.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.3.6 or newer.

  Full record and what to do →NVD recordfortiguard.comraw.githubusercontent.com

• Feb 6, 2018In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (fromCVE-2018-6389 · WordPress plugins & themes · reported by MITREHigh 7.5

  In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

  Affected

  up to 4.9.2

  What to do

  Affects up to 4.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

• Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6469 · WordPress plugins & themes · reported by MITREMedium 6.1

  A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_tags parameter to wp-admin/options-general.php.

  Product

  flickrRSS

  Affected

  5.3.1 to 5.3.1

  What to do

  Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6468 · WordPress plugins & themes · reported by MITREMedium 6.1

  A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_id parameter to wp-admin/options-general.php.

  Product

  flickrRSS

  Affected

  5.3.1 to 5.3.1

  What to do

  Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Feb 6, 2018The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.CVE-2018-6467 · WordPress plugins & themes · reported by MITREHigh 8.8

  The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.

  Affected

  5.3.1 to 5.3.1

  What to do

  Affects 5.3.1 to 5.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Feb 6, 2018A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script oCVE-2018-6466 · WordPress plugins & themes · reported by MITREMedium 6.1

  A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_set parameter to wp-admin/options-general.php.

  Product

  flickrRSS

  Affected

  5.3.1 to 5.3.1

  What to do

  Affects 5.3.1 to 5.3.1. Update flickrRSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Feb 5, 2018Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress.CVE-2015-4179 · WordPress plugins & themes · reported by MITREHigh 8.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress.

  Product

  Codestyling Localization

  Affected

  up to 1.99.30

  What to do

  Affects up to 1.99.30. Update Codestyling Localization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordopenwall.comopenwall.com

• Jan 31, 2018The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.CVE-2018-6465 · WordPress plugins & themes · reported by MITREMedium 6.1

  The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.

  Product

  PropertyHive

  Fixed in

  1.4.15

  What to do

  Update PropertyHive to 1.4.15 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Jan 30, 2018admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, CVE-2018-6195 · WordPress plugins & themes · reported by MITREHigh 7.2

  admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.

  Product

  admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images)

  Fixed in

  2.1.1

  What to do

  Update admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) to 2.1.1 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comseclists.org

• Jan 27, 2018The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray paramCVE-2018-6357 · WordPress plugins & themes · reported by MITREHigh 8.8

  The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.

  Product

  acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget

  Fixed in

  3.2.6

  What to do

  Update acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget to 3.2.6 or newer.

  Full record and what to do →NVD recordlists.openwall.networdpress.org

• Jan 26, 2018An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress.CVE-2018-6015 · WordPress plugins & themes · reported by MITREHigh 7.5

  An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data.

  Product

  An issue was discovered in the "Email Subscribers & Newsletters

  Fixed in

  3.4.8

  What to do

  Update An issue was discovered in the "Email Subscribers & Newsletters to 3.4.8 or newer.

  Full record and what to do →NVD recordblog.threatpress.comwordpress.org

• Jan 22, 2018The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview CVE-2018-6002 · WordPress plugins & themes · reported by MITREMedium 6.1

  The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter).

  Affected

  up to 3.9

  What to do

  Affects up to 3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddefensecode.comdefensecode.com

• Jan 22, 2018The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview paraCVE-2018-6001 · WordPress plugins & themes · reported by MITREMedium 6.1

  The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter).

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddefensecode.comdefensecode.com

• Jan 18, 2018WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).CVE-2018-5776 · WordPress plugins & themes · reported by MITREMedium 6.1

  WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).

  Fixed in

  4.9.2

  What to do

  Update the plugin to 4.9.2 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orggithub.com

• Jan 16, 2018The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.CVE-2017-18032 · WordPress plugins & themes · reported by MITREMedium 6.1

  The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.

  Product

  download-manager

  Fixed in

  2.9.52

  What to do

  Update download-manager to 2.9.52 or newer.

  Full record and what to do →NVD recordsecurity.dxw.comwordpress.org

• Jan 13, 2018The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-adminCVE-2018-5695 · WordPress plugins & themes · reported by MITREHigh 7.2

  The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php.

  Affected

  4.4.4 to 4.4.4

  What to do

  Affects 4.4.4 to 4.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com

• Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5673 · WordPress plugins & themes · reported by MITREHigh 8.8

  An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.

  Product

  booking-calendar

  Affected

  2.1.7 to 2.1.7

  What to do

  Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5672 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.

  Product

  booking-calendar

  Affected

  2.1.7 to 2.1.7

  What to do

  Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5671 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.

  Product

  booking-calendar

  Affected

  2.1.7 to 2.1.7

  What to do

  Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.CVE-2018-5670 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.

  Product

  booking-calendar

  Affected

  2.1.7 to 2.1.7

  What to do

  Affects 2.1.7 to 2.1.7. Update booking-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the read-and-understood plugin 2.1 for WordPress.CVE-2018-5669 · WordPress plugins & themes · reported by MITREHigh 8.8

  An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php.

  Product

  read-and-understood

  Affected

  2.1 to 2.1

  What to do

  Affects 2.1 to 2.1. Update read-and-understood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jan 12, 2018An issue was discovered in the read-and-understood plugin 2.1 for WordPress.CVE-2018-5668 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_title parameter.

  Product

  read-and-understood

  Affected

  2.1 to 2.1

  What to do

  Affects 2.1 to 2.1. Update read-and-understood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jan 12, 2018An issue was discovered in the read-and-understood plugin 2.1 for WordPress.CVE-2018-5667 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_pattern parameter.

  Product

  read-and-understood

  Affected

  2.1 to 2.1

  What to do

  Affects 2.1 to 2.1. Update read-and-understood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5666 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color parameter.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5665 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height parameter.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5664 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 parameter.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5663 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_link parameter.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5662 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5661 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width parameter.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5660 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_sub_title parameter.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5659 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_title parameter.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5658 · WordPress plugins & themes · reported by MITREHigh 8.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5657 · WordPress plugins & themes · reported by MITREMedium 4.8

  An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_icon parameter.

  Product

  responsive-coming-soon-page

  Affected

  1.1.18 to 1.1.18

  What to do

  Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwpvulndb.com

• Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5656 · WordPress plugins & themes · reported by MITREHigh 8.8

  An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php.

  Product

  weblizar-pinterest-feeds

  Affected

  1.1.1 to 1.1.1

  What to do

  Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5655 · WordPress plugins & themes · reported by MITREMedium 6.1

  An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter.

  Product

  weblizar-pinterest-feeds

  Affected

  1.1.1 to 1.1.1

  What to do

  Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.