Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

524new WordPress flaws this week

391,883entries in the database

5,867 results · page 99 of 118

May 23, 2017Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathnamCVE-2015-5609 · WordPress plugins & themes · reported by MITRECritical 9.1
Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.
Product
Image Export
Affected
1.1 to 1.1
What to do
Affects 1.1 to 1.1. Update Image Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
May 23, 2017Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathnaCVE-2015-5469 · WordPress plugins & themes · reported by MITREHigh 7.5
Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.
Product
MDC YouTube Downloader
Affected
2.1.0 to 2.1.0
What to do
Affects 2.1.0 to 2.1.0. Update MDC YouTube Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
May 23, 2017Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2015-5468 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to includes/download.php.
Product
Directory traversal vulnerability in the WP e-Commerce Shop Styling
Fixed in
2.6
What to do
Update Directory traversal vulnerability in the WP e-Commerce Shop Styling to 2.6 or newer.
Full record and what to do →NVD record openwall.com openwall.com
May 23, 2017Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2015-4704 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the File parameter to download.php.
Product
Download Zip Attachments
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Download Zip Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com vapid.dhs.org
May 23, 2017Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote atCVE-2015-4455 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
Product
Aviary Image Editor Add-on For Gravity Forms
Affected
up to 3.0
What to do
Affects up to 3.0. Update Aviary Image Editor Add-on For Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com vapid.dhs.org
May 18, 2017In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.CVE-2017-9066 · WordPress plugins & themes · reported by MITREHigh 8.6
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
May 18, 2017In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.CVE-2017-9065 · WordPress plugins & themes · reported by MITREHigh 7.5
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 18, 2017In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updCVE-2017-9064 · WordPress plugins & themes · reported by MITREHigh 8.8
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 18, 2017In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.CVE-2017-9063 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 18, 2017In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.CVE-2017-9062 · WordPress plugins & themes · reported by MITREHigh 8.6
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 18, 2017In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not propCVE-2017-9061 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 17, 2017Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redireCVE-2015-4070 · WordPress plugins & themes · reported by MITREMedium 6.1
Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Product
Wow Moodboard Lite
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update Wow Moodboard Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapid.dhs.org
May 17, 2017Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers toCVE-2015-3998 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
Product
adsense-click-fraud-monitoring
Affected
1.7.5 to 1.7.5
What to do
Affects 1.7.5 to 1.7.5. Update adsense-click-fraud-monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
May 10, 2017CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL.CVE-2017-8875 · WordPress plugins & themes · reported by MITREMedium 6.5
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL.
Product
CSRF in the Clean Login
Fixed in
1.8
What to do
Update CSRF in the Clean Login to 1.8 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
May 4, 2017WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwoCVE-2017-8295 · WordPress plugins & themes · reported by MITREMedium 5.9
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.
Affected
up to 4.7.4
What to do
Affects up to 4.7.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record debian.org securityfocus.com
Apr 24, 2017There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings.CVE-2017-8100 · WordPress plugins & themes · reported by MITREMedium 6.5
There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings.
Product
There is CSRF in the CopySafe Web Protection
Fixed in
2.6
What to do
Update There is CSRF in the CopySafe Web Protection to 2.6 or newer.
Full record and what to do →NVD record seclists.org securityfocus.com
Apr 24, 2017There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.CVE-2017-8099 · WordPress plugins & themes · reported by MITREHigh 8.1
There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.
Product
There is CSRF in the WHIZZ
Fixed in
1.1.1
What to do
Update There is CSRF in the WHIZZ to 1.1.1 or newer.
Full record and what to do →NVD record seclists.org plugins.trac.wordpress.org
Apr 24, 2017XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.CVE-2017-7723 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.
Fixed in
1.2.5
What to do
Update the plugin to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 12, 2017SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendarCVE-2017-7719 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.
Product
SQL injection in the Spider Event Calendar (aka spider-event-calendar)
Fixed in
1.5.52
What to do
Update SQL injection in the Spider Event Calendar (aka spider-event-calendar) to 1.5.52 or newer.
Full record and what to do →NVD record lists.openwall.net securityfocus.com
Apr 2, 2017The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not requiCVE-2017-1001000 · WordPress plugins & themes · reported by 46fe6300-5254-4a98-9594-a9567bec8179High 7.5
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
Fixed in
4.7.2
What to do
Update the plugin to 4.7.2 or newer.
Full record and what to do →NVD record openwall.com securitytracker.com
Mar 17, 2017An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress.CVE-2017-6955 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack.
Product
An issue was discovered in by-email/by-email.php in the Invite Anyone
Fixed in
1.3.15
What to do
Update An issue was discovered in by-email/by-email.php in the Invite Anyone to 1.3.15 or newer.
Full record and what to do →NVD record securityfocus.com github.com
Mar 17, 2017An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress.CVE-2017-6954 · WordPress plugins & themes · reported by MITREMedium 4.3
An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.
Product
An issue was discovered in includes/component.php in the BuddyPress Docs
Fixed in
1.9.3
What to do
Update An issue was discovered in includes/component.php in the BuddyPress Docs to 1.9.3 or newer.
Full record and what to do →NVD record securityfocus.com github.com
Mar 16, 2017Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remotCVE-2016-0770 · WordPress plugins & themes · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable.
Product
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory
Fixed in
8.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory to 8.5.9 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 11, 2017In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of serCVE-2017-6819 · WordPress plugins & themes · reported by MITREMedium 6.5
In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 11, 2017In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.CVE-2017-6818 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 11, 2017In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.CVE-2017-6817 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 11, 2017In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.CVE-2017-6816 · WordPress plugins & themes · reported by MITREMedium 4.9
In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 11, 2017In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.CVE-2017-6815 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 11, 2017In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata.CVE-2017-6814 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record openwall.com debian.org
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6578 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: subscriber_email.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6577 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6576 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/campaign-delete.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6575 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: member_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6574 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6573 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit-list.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6572 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/add_member.php with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6571 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6570 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign-list.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 2, 2017Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.CVE-2017-6104 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
Affected
up to 3.0
What to do
Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Mar 2, 2017Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1.CVE-2017-6103 · WordPress plugins & themes · reported by larry0@me.comMedium 6.1
Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1.
Affected
0.1.1 to 0.1.1
What to do
Affects 0.1.1 to 0.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Mar 2, 2017Persistent XSS in wordpress plugin rockhoist-badges v1.2.2.CVE-2017-6102 · WordPress plugins & themes · reported by larry0@me.comMedium 6.1
Persistent XSS in wordpress plugin rockhoist-badges v1.2.2.
Affected
1.2.2 to 1.2.2
What to do
Affects 1.2.2 to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6098 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication to Wordpress admin) with the POST Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6097 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authentication to Wordpress admin) with the POST Parameter: camp_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6096 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires authentication to Wordpress admin) with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6095 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with the GET Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 10, 2017An issue was discovered in the WP Mail plugin before 1.2 for WordPress.CVE-2017-5942 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allow you to execute JavaScript in the context of the user receiving the mail.
Product
An issue was discovered in the WP Mail
Fixed in
1.2
What to do
Update An issue was discovered in the WP Mail to 1.2 or newer.
Full record and what to do →NVD record securityfocus.com cjc.im
Jan 29, 2017wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2: Cross-site scripting (XSS)CVE-2017-5612 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.
Product
wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2
Fixed in
4.7.2
What to do
Update wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 to 4.7.2 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 29, 2017wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2: SQL injectionCVE-2017-5611 · WordPress plugins & themes · reported by security@debian.orgCritical 9.8
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.
Product
wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2
Fixed in
4.7.2
What to do
Update wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 to 4.7.2 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 29, 2017wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface,CVE-2017-5610 · WordPress plugins & themes · reported by security@debian.orgMedium 5.3
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.
Fixed in
4.7.2
What to do
Update the plugin to 4.7.2 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 23, 2017Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL comCVE-2016-0769 · WordPress plugins & themes · reported by Red HatHigh 8.8
Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
Product
eShop
Affected
6.3.14 to 6.3.14
What to do
Affects 6.3.14 to 6.3.14. Update eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.