Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

35 results

Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.CVE-2026-62034 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.
Affected
up to 1.1.21
What to do
Affects up to 1.1.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Before After Image Comparison – Image comparison for WP: Missing AuthorizationCVE-2026-62028 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.
Product
Before After Image Comparison – Image comparison for WP
Affected
up to 1.1.21
What to do
Affects up to 1.1.21. Update Before After Image Comparison – Image comparison for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.CVE-2026-66653 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 5, 2026Content Egg – Affiliate Product Importer & Price Comparison: Arbitrary File DeletionCVE-2026-15979 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'img_file' field within the cegg_data post metadata: the value passes only through wp_strip_all_tags() (which does not strip path traversal sequences), is stored directly in post meta, and is later concatenated without normalization into a filesystem path in getFullImgPath() before being passed to PHP's unlink(). This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.
Product
Content Egg – Affiliate Product Importer & Price Comparison
Affected
up to 11.3.0
What to do
Affects up to 11.3.0. Update Content Egg – Affiliate Product Importer & Price Comparison to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Solaris: Deserialization of Untrusted DataCVE-2026-22454 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
Product
Solaris
Affected
up to 2.5
What to do
Affects up to 2.5. Update Solaris to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Popularis Extra: Cross-Site Request Forgery (CSRF)CVE-2026-25422 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Extra: from n/a through <= 1.2.10.
Product
Popularis Extra
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Popularis Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2025Check Plagiarism: Unauthorized modification of dataCVE-2025-11172 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_action() function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the API key.
Product
Check Plagiarism
Affected
up to 2.0
What to do
Affects up to 2.0. Update Check Plagiarism to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 5, 2025REHub - Price Comparison, Multi Vendor Marketplace: Information ExposureCVE-2025-7368 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 19.9.7 via the 'ajax_action_re_getfullcontent' function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected posts that they should not have access to.
Product
REHub - Price Comparison, Multi Vendor Marketplace
Affected
up to 19.9.7
What to do
Affects up to 19.9.7. Update REHub - Price Comparison, Multi Vendor Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 5, 2025The REHub - Price Comparison, Multi Vendor Marketplace: Arbitrary shortcode executionCVE-2025-7366 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 19.9.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The REHub - Price Comparison, Multi Vendor Marketplace
Affected
up to 19.9.7
What to do
Affects up to 19.9.7. Update The REHub - Price Comparison, Multi Vendor Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 14, 2025Alike - WordPress Custom Post Comparison: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28975 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through <= 3.0.1.
Product
Alike - WordPress Custom Post Comparison
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Alike - WordPress Custom Post Comparison to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Popularis Verse: Cross-Site Request Forgery (CSRF)CVE-2024-38763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themes4wp Popularis Verse popularis-verse allows Cross Site Request Forgery.This issue affects Popularis Verse: from n/a through <= 1.1.1.
Product
Popularis Verse
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Popularis Verse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2024Loan Comparison: Stored Cross-Site ScriptingCVE-2024-12814 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Loan Comparison plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'loancomparison' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Loan Comparison
Affected
up to 2.0
What to do
Affects up to 2.0. Update Loan Comparison to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024Popularis Extra: Information ExposureCVE-2024-10795 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Product
Popularis Extra
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Popularis Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Audio Comparison Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51627 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kaedinger Audio Comparison Lite audio-comparison-lite allows Stored XSS.This issue affects Audio Comparison Lite: from n/a through <= 3.4.
Product
Audio Comparison Lite
Affected
up to 3.4
What to do
Affects up to 3.4. Update Audio Comparison Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 4, 2024Popularis Extra: Reflected Cross-Site ScriptingCVE-2024-9353 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Popularis Extra
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Popularis Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024Slider comparison image before and after: Stored Cross-Site ScriptingCVE-2024-8543 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [sciba] shortcode in all versions up to, and including, 0.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider comparison image before and after
Affected
up to 0.8.3
What to do
Affects up to 0.8.3. Update Slider comparison image before and after to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2024Calendarista Basic Edition: Missing AuthorizationCVE-2024-30534 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.5.
Product
Calendarista Basic Edition
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 30, 2024Comparison Slider: Unauthorized modification of dataCVE-2024-4427 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comparison Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 1.0.5. This makes it possible for authenticated attackers, with subscriber access or above, to change plugin settings and perform other actions such deleting sliders.
Product
Comparison Slider
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Comparison Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
May 30, 2024Comparison Slider: Cross-Site Request ForgeryCVE-2024-4426 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comparison Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on several functions hooked to AJAX actions. This makes it possible for unauthenticated attackers to change slider titles, delete sliders and modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Comparison Slider
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Comparison Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
May 30, 2024Comparison Slider: Stored Cross-Site ScriptingCVE-2024-4422 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Comparison Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider title parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Comparison Slider
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Comparison Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 15, 2024Calendarista Basic Edition: Cross-Site Request Forgery (CSRF)CVE-2024-31942 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.
Product
Calendarista Basic Edition
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Calendarista: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30240 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Typps Calendarista.This issue affects Calendarista: from n/a through 15.5.7.
Product
Calendarista
Affected
up to 15.5.7
What to do
Affects up to 15.5.7. Update Calendarista to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Calendarista Basic Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.
Product
Calendarista Basic Edition
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Bulgarisation for WooCommerce: Unauthorized accessCVE-2024-0683 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in all versions up to, and including, 3.0.14. This makes it possible for unauthenticated and authenticated attackers, with subscriber-level access and above, to generate and delete labels.
Product
Bulgarisation for WooCommerce
Affected
up to 3.0.14
What to do
Affects up to 3.0.14. Update Bulgarisation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 12, 2024Bulgarisation for WooCommerce: Cross-Site Request ForgeryCVE-2024-2395 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.14. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to generate and delete labels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Bulgarisation for WooCommerce
Affected
up to 3.0.14
What to do
Affects up to 3.0.14. Update Bulgarisation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactivatCVE-2022-46805 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactivation of plugin rulesets.
Fixed in
2.3.2
What to do
Update the plugin to 2.3.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2023Loan Comparison: Does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcodeCVE-2023-0442 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.
Product
Loan Comparison
Fixed in
1.5.3
What to do
Update Loan Comparison to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Loan Comparison: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0366 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Loan Comparison
Fixed in
1.5.3
What to do
Update Loan Comparison to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 2, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions.CVE-2022-46815 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions.
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 5, 2022Clerk: Is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site optionsCVE-2022-3907 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.
Product
Clerk
Fixed in
4.0.0
What to do
Update Clerk to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2022WP 2FA: Uses comparison operators that don't mitigate time-based attacksCVE-2022-2891 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.
Product
WP 2FA
Fixed in
2.3.0
What to do
Update WP 2FA to 2.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier): Does not escape the effects parameter before outputting it back in an attribute in an admin pageCVE-2021-25031 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)
Fixed in
9.7.1
What to do
Update Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) to 9.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2020The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison.CVE-2020-10568 · WordPress plugins & themes · reported by MITREHigh 8.8
The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.
Product
sitepress-multilingual-cms (WPML)
Fixed in
4.3.7-b.2
What to do
Update sitepress-multilingual-cms (WPML) to 4.3.7-b.2 or newer.
Full record and what to do →NVD record medium.com wpvulndb.com
Oct 10, 2016Reflected XSS in wordpress plugin anti-plagiarism v3.60CVE-2016-1000128 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin anti-plagiarism v3.60
Affected
up to 3.60
What to do
Affects up to 3.60. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Nov 9, 2015The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgetCVE-2015-5730 · WordPress plugins & themes · reported by MITREMedium 5
The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.
Fixed in
4.2.4
What to do
Update the plugin to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.