Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
33added in the last 30 days
547new WordPress flaws this week
391,964entries in the database

5,770 results · page 99 of 116

  • Sep 19, 2017Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPreCVE-2015-4089 · WordPress plugins & themes · reported by MITREHigh 8.8

    Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.

    Fixed in
    0.8.3.5
    What to do
    Update the plugin to 0.8.3.5 or newer.

    Full record and what to do →NVD recordopenwall.comwordpress.org

  • Sep 19, 2017Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or CVE-2015-3299 · WordPress plugins & themes · reported by MITREMedium 6.1

    Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order.

    Product
    Cross-site scripting (XSS) vulnerability in the Floating Social Bar
    Fixed in
    1.1.7
    What to do
    Update Cross-site scripting (XSS) vulnerability in the Floating Social Bar to 1.1.7 or newer.

    Full record and what to do →NVD recordopenwall.comsecurityfocus.com

  • Sep 17, 2017WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstraCVE-2017-14530 · WordPress plugins & themes · reported by MITREHigh 8

    WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences.

    Product
    WP_Admin_UI in the Crony Cronjob Manager
    Fixed in
    0.4.7
    What to do
    Update WP_Admin_UI in the Crony Cronjob Manager to 0.4.7 or newer.

    Full record and what to do →NVD recordcybersecurityworks.comgithub.com

  • Sep 14, 2017Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter CVE-2017-1002028 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.

    Affected
    1.0 to 1.0
    What to do
    Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responCVE-2017-1002027 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php.

    Affected
    1.0 to 1.0
    What to do
    Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameterCVE-2017-1002026 · WordPress plugins & themes · reported by larry0@me.comHigh 8.8

    Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.

    Affected
    3.1.37.11.l to 3.1.37.11.l
    What to do
    Affects 3.1.37.11.l to 3.1.37.11.l. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passinCVE-2017-1002025 · WordPress plugins & themes · reported by larry0@me.comHigh 7.2

    Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement.

    Affected
    1.0 to 1.0
    What to do
    Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/CVE-2017-1002023 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php

    Affected
    1.3.2 to 1.3.2
    What to do
    Affects 1.3.2 to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.CVE-2017-1002022 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.

    Affected
    1.01.8 to 1.01.8
    What to do
    Affects 1.01.8 to 1.01.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an CVE-2017-1002021 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query.

    Affected
    1.01.8 to 1.01.8
    What to do
    Affects 1.01.8 to 1.01.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.CVE-2017-1002020 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.

    Affected
    1.01.8 to 1.01.8
    What to do
    Affects 1.01.8 to 1.01.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the eCVE-2017-1002019 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.

    Affected
    1.02.2 to 1.02.2
    What to do
    Affects 1.02.2 to 1.02.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the evCVE-2017-1002018 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.

    Affected
    1.02.2 to 1.02.2
    What to do
    Affects 1.02.2 to 1.02.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.CVE-2017-1002017 · WordPress plugins & themes · reported by larry0@me.comMedium 6.1

    Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.

    Affected
    1.0 to 1.0
    What to do
    Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that CVE-2017-1002016 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files.

    Affected
    0.7 to 0.7
    What to do
    Affects 0.7 to 0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallerCVE-2017-1002015 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter.

    Affected
    1.5.2 to 1.5.2
    What to do
    Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name paCVE-2017-1002014 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter.

    Affected
    1.5.2 to 1.5.2
    What to do
    Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.phpCVE-2017-1002013 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php.

    Affected
    1.5.2 to 1.5.2
    What to do
    Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not CVE-2017-1002012 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement.

    Affected
    1.5.2 to 1.5.2
    What to do
    Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_descCVE-2017-1002011 · WordPress plugins & themes · reported by larry0@me.comMedium 5.4

    Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database.

    Affected
    1.5.2 to 1.5.2
    What to do
    Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL inCVE-2017-1002010 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.

    Affected
    1.58 to 1.58
    What to do
    Affects 1.58 to 1.58. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordmembership.officeautopilot.comvapidlabs.com

  • Sep 14, 2017Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL inCVE-2017-1002009 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.

    Affected
    1.58 to 1.58
    What to do
    Affects 1.58 to 1.58. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordmembership.officeautopilot.comvapidlabs.com

  • Sep 14, 2017Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/doCVE-2017-1002008 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.

    Affected
    1.58 to 1.58
    What to do
    Affects 1.58 to 1.58. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into thCVE-2017-1002007 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5

    Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.

    Affected
    1.5 to 1.5
    What to do
    Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com

  • Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts intoCVE-2017-1002006 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5

    Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.

    Affected
    1.5 to 1.5
    What to do
    Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com

  • Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the enCVE-2017-1002005 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5

    Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query.

    Affected
    1.5 to 1.5
    What to do
    Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com

  • Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of aCVE-2017-1002004 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5

    Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query.

    Affected
    1.5 to 1.5
    What to do
    Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com

  • Sep 14, 2017Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invediCVE-2017-1002003 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

    Affected
    1.1.4 to 1.1.4
    What to do
    Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com

  • Sep 14, 2017Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/CVE-2017-1002002 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

    Affected
    2.0 to 2.0
    What to do
    Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com

  • Sep 14, 2017Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.CVE-2017-1002001 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

    Affected
    1.05 to 1.05
    What to do
    Affects 1.05 to 1.05. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php dCVE-2017-1002000 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content.

    Affected
    3.0 to 3.0
    What to do
    Affects 3.0 to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com

  • Sep 12, 2017In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticaCVE-2015-9230 · WordPress plugins & themes · reported by MITREMedium 4.8

    In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordopenwall.comcxsecurity.com

  • Sep 12, 2017In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via CVE-2015-9229 · WordPress plugins & themes · reported by MITREMedium 4.8

    In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.

    Product
    Photocrati NextGEN Gallery
    Affected
    2.1.15 to 2.1.15
    What to do
    Affects 2.1.15 to 2.1.15. Update Photocrati NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordcybersecurityworks.comgithub.com

  • Sep 12, 2017In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extensionCVE-2015-9228 · WordPress plugins & themes · reported by MITREHigh 8.8

    In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.

    Product
    Photocrati NextGEN Gallery
    What to do
    Update Photocrati NextGEN Gallery to the newest version.

    Full record and what to do →NVD recordopenwall.comcybersecurityworks.com

  • Sep 11, 2017The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of aCVE-2017-14313 · WordPress plugins & themes · reported by MITREMedium 6.1

    The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().

    Product
    shibboleth_login_form function in shibboleth.php in the Shibboleth
    Fixed in
    1.8
    What to do
    Update shibboleth_login_form function in shibboleth.php in the Shibboleth to 1.8 or newer.

    Full record and what to do →NVD recorddebian.orgbugs.debian.org

  • Sep 11, 2017Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web scrCVE-2015-8354 · WordPress plugins & themes · reported by MITREMedium 6.1

    Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php.

    Product
    Ultimate Member
    Fixed in
    1.3.29
    What to do
    Update Ultimate Member to 1.3.29 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

  • Sep 11, 2017Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2015-8353 · WordPress plugins & themes · reported by MITREMedium 6.1

    Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.

    Product
    Cross-site scripting (XSS) vulnerability in the Role Scoper
    Fixed in
    1.3.67
    What to do
    Update Cross-site scripting (XSS) vulnerability in the Role Scoper to 1.3.67 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

  • Sep 11, 2017PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticateCVE-2015-8351 · WordPress plugins & themes · reported by MITRECritical 9

    PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.

    Product
    PHP remote file inclusion vulnerability in the Gwolle Guestbook
    Fixed in
    1.5.4
    What to do
    Update PHP remote file inclusion vulnerability in the Gwolle Guestbook to 1.5.4 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

  • Sep 11, 2017Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web scriCVE-2015-8350 · WordPress plugins & themes · reported by MITREMedium 6.1

    Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.

    Product
    Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action
    Fixed in
    2.5.1
    What to do
    Update Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action to 2.5.1 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

  • Sep 7, 2017Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.CVE-2015-4697 · WordPress plugins & themes · reported by MITREHigh 8.8

    Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.

    Fixed in
    6.4.9.3
    What to do
    Update the plugin to 6.4.9.3 or newer.

    Full record and what to do →NVD recordseclists.orgopenwall.com

  • Sep 7, 2017SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.CVE-2015-3314 · WordPress plugins & themes · reported by MITREHigh 8.1

    SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.

    Fixed in
    1.5.5
    What to do
    Update the plugin to 1.5.5 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com

  • Sep 7, 2017SQL injection vulnerability in WordPress Community Events plugin before 1.4.CVE-2015-3313 · WordPress plugins & themes · reported by MITRECritical 9.8

    SQL injection vulnerability in WordPress Community Events plugin before 1.4.

    Fixed in
    1.4
    What to do
    Update the plugin to 1.4 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com

  • Sep 7, 2017SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questioCVE-2017-9834 · WordPress plugins & themes · reported by MITRECritical 9.8

    SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.

    Product
    SQL injection vulnerability in the WatuPRO
    Fixed in
    5.5.3.7
    What to do
    Update SQL injection vulnerability in the WatuPRO to 5.5.3.7 or newer.

    Full record and what to do →NVD recordwpvulndb.comexploit-db.com

  • Sep 4, 2017The Participants Database plugin before 1.7.5.10 for WordPress has XSS.CVE-2017-14126 · WordPress plugins & themes · reported by MITREMedium 6.1

    The Participants Database plugin before 1.7.5.10 for WordPress has XSS.

    Product
    Participants Database
    Fixed in
    1.7.5.10
    What to do
    Update Participants Database to 1.7.5.10 or newer.

    Full record and what to do →NVD recordlimbenjamin.comwordpress.org

  • Aug 29, 2017Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commaCVE-2015-7517 · WordPress plugins & themes · reported by Red HatCritical 9.8

    Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or (2) class-doifd-landing-page.php in public/includes/.

    Product
    Multiple SQL injection vulnerabilities in the Double Opt-In for Download
    Fixed in
    2.0.9
    What to do
    Update Multiple SQL injection vulnerabilities in the Double Opt-In for Download to 2.0.9 or newer.

    Full record and what to do →NVD recordpermalink.gmane.orgsecurityfocus.com

  • Aug 23, 2017The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.CVE-2017-13137 · WordPress plugins & themes · reported by MITRECritical 9.8

    The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.

    Affected
    1.0.5 to 1.0.5
    What to do
    Affects 1.0.5 to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

  • Aug 20, 2017The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() iCVE-2017-12977 · WordPress plugins & themes · reported by MITREHigh 7.2

    The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.

    Product
    Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery
    Fixed in
    1.3.51
    What to do
    Update Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery to 1.3.51 or newer.

    Full record and what to do →NVD recordgithub.comwordpress.org

  • Aug 18, 2017lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parCVE-2017-12949 · WordPress plugins & themes · reported by MITREHigh 8.8

    lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF.

    Product
    Podlove Podcast Publisher
    Affected
    up to 2.5.3
    What to do
    Affects up to 2.5.3. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recorddefensecode.comdefensecode.com

  • Aug 18, 2017Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.CVE-2017-12948 · WordPress plugins & themes · reported by MITREMedium 6.1

    Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.

    Product
    PressForward
    Affected
    up to 4.3.0
    What to do
    Affects up to 4.3.0. Update PressForward to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recorddefensecode.comdefensecode.com

  • Aug 18, 2017classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameCVE-2017-12947 · WordPress plugins & themes · reported by MITREHigh 7.2

    classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.

    Product
    classes\controller\admin\modals.php in the Easy Modal
    Fixed in
    2.1.0
    What to do
    Update classes\controller\admin\modals.php in the Easy Modal to 2.1.0 or newer.

    Full record and what to do →NVD recorddefensecode.comwordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.