Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
42 results
Oct 10, 2026MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings vCVE-2026-108695 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.
- Affected
- up to 5.0.19
- What to do
- Affects up to 5.0.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026File Media Renamer: Does not verify that the requesting user is authorised to modify a given media attachmentCVE-2026-94278 · WordPress plugins & themes · reported by WPScanMedium 5.5
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
- Product
- File Media Renamer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update File Media Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2026Motors: Does not properly verify that a user is authorised to modify a listing before processing one of its listing management actionsCVE-2026-91023 · WordPress plugins & themes · reported by WPScanLow 3.1
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.
- Product
- Motors
- Fixed in
- 1.4.124
- What to do
- Update Motors to 1.4.124 or newer.
Oct 1, 2026Extendify: Stored Cross-Site ScriptingCVE-2026-85679 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route's permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path.
- Product
- Extendify
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Extendify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026Booking Manager: Does not verify that a request to modify a user's Booking Manager WordPress plugin before 2CVE-2026-91025 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
- Product
- Booking Manager
- Fixed in
- 2.1.21
- What to do
- Update Booking Manager to 2.1.21 or newer.
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favoritesCVE-2026-84150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.9.5
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpointsCVE-2026-92420 · WordPress plugins & themes · reported by WPScanLow 3.8
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.
- Product
- Hydra Booking — Appointment Scheduling & Booking Calendar
- Fixed in
- 1.2.2
- What to do
- Update Hydra Booking — Appointment Scheduling & Booking Calendar to 1.2.2 or newer.
Sep 19, 2026WP Import Export Lite: Does not verify that the user running an import is permitted to create or modify user accounts and assign rolesCVE-2026-76554 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.35
- What to do
- Update WP Import Export Lite to 3.9.35 or newer.
Sep 16, 2026Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users.CVE-2026-89031 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.
- Fixed in
- 9.1.0
- What to do
- Update the plugin to 9.1.0 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to itCVE-2026-77705 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.10
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.10 or newer.
Sep 9, 2026WP Travel: Does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handlerCVE-2026-13144 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
- Product
- WP Travel
- Fixed in
- 12.0.2
- What to do
- Update WP Travel to 12.0.2 or newer.
Aug 4, 2026Brizy: Does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting itCVE-2026-16068 · WordPress plugins & themes · reported by WPScanLow 3.5
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
- Product
- Brizy
- Fixed in
- 2.8.19
- What to do
- Update Brizy to 2.8.19 or newer.
Jul 31, 2026Events Made Easy: Does not verify that the requester is authorized to modify the targeted recordCVE-2026-14843 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
- Product
- Events Made Easy
- Fixed in
- 3.1.4
- What to do
- Update Events Made Easy to 3.1.4 or newer.
Jul 28, 2026Shortcodify: Stored Cross-Site ScriptingCVE-2026-11598 · WordPress plugins & themes · reported by WordfenceMedium 5
The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Shortcodify
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Shortcodify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2026User Registration & Membership: Does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current userCVE-2026-11963 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.
- Product
- User Registration & Membership
- Fixed in
- 5.2.2
- What to do
- Update User Registration & Membership to 5.2.2 or newer.
Jun 15, 2026WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar setCVE-2016-20084 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.dwbooster.comexploit-db.com
Jun 4, 2026WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by eCVE-2019-25738 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.framework-y.comwordpress.framework-y.com
Mar 11, 2026Datalogics Ecommerce Delivery: Exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verificationCVE-2026-2631 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.
- Product
- Datalogics Ecommerce Delivery
- Fixed in
- 2.6.60
- What to do
- Update Datalogics Ecommerce Delivery to 2.6.60 or newer.
Jan 15, 2026process_upload.php due to missing file type validation: Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file uploadCVE-2011-10041 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.
- Product
- process_upload.php due to missing file type validation
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update process_upload.php due to missing file type validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstorm.newswpscan.com
Aug 5, 2025the third-party `uploadify.php` script: WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file uploadCVE-2012-10027 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
- Product
- the third-party `uploadify.php` script
- Affected
- up to 1.35.0
- What to do
- Affects up to 1.35.0. Update the third-party `uploadify.php` script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordweb.archive.orgraw.githubusercontent.com
Apr 17, 2025Feedify – Web Push Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32540 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in feedify Feedify – Web Push Notifications push-notification-by-feedify allows Reflected XSS.This issue affects Feedify – Web Push Notifications: from n/a through <= 2.4.5.
- Product
- Feedify – Web Push Notifications
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Feedify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13874 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Feedify
- Fixed in
- 2.4.6
- What to do
- Update Feedify to 2.4.6 or newer.
Dec 20, 2024Feedify – Web Push Notifications: Reflected Cross-Site ScriptingCVE-2024-11811 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Feedify – Web Push Notifications plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'platform', 'phone', 'email', and 'store_url' parameters. in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Feedify – Web Push Notifications
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 18, 2024Debrandify · Remove or Replace WordPress Branding: Stored Cross-Site ScriptingCVE-2024-9674 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Debrandify · Remove or Replace WordPress Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Debrandify · Remove or Replace WordPress Branding
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Debrandify · Remove or Replace WordPress Branding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 7, 2024ARForms - Premium WordPress Form Builder: Allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploadedCVE-2024-4620 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form
- Product
- ARForms - Premium WordPress Form Builder
- Fixed in
- 6.6
- What to do
- Update ARForms - Premium WordPress Form Builder to 6.6 or newer.
Feb 13, 2023GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training: Does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary postsCVE-2023-0405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.
- Product
- GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training
- Fixed in
- 1.4.38
- What to do
- Update GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training to 1.4.38 or newer.
Oct 31, 2022WP Total Hacks: Does not prevent low privilege users from modifying the plugin's settingsCVE-2022-3096 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other users, like administrators, due to the lack of sanitisation and escaping as well.
- Product
- WP Total Hacks
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update WP Total Hacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2022WP HTML Mail: Unauthorized access which allows unauthenticated attackers to retrieve and modify theme settingsCVE-2022-0218 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.
- Product
- WP HTML Mail
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update WP HTML Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Feedify – Web Push Notifications: Reflected Cross-Site ScriptingCVE-2021-38352 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8.
- Product
- Feedify – Web Push Notifications
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 2, 2021User Registration & User Profile – Profile Builder: Does not sanitise or escape its 'Modify default Redirect Delay timer' settingCVE-2021-24448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- User Registration & User Profile – Profile Builder
- Fixed in
- 3.4.8
- What to do
- Update User Registration & User Profile – Profile Builder to 3.4.8 or newer.
Apr 5, 2021Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify coursCVE-2021-24184 · WordPress plugins & themes · reported by WPScanHigh 8.8
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
- Product
- Tutor LMS – eLearning and online course solution
- Fixed in
- 1.7.7
- What to do
- Update Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jan 9, 2020A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify severalCVE-2020-6167 · WordPress plugins & themes · reported by MITREHigh 8.8
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo.
- Affected
- up to 2.10
- What to do
- Affects up to 2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Dec 19, 2019The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirCVE-2019-19915 · WordPress plugins & themes · reported by MITRECritical 9
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.
- Product
- 301 Redirects - Easy Redirect Manager
- Fixed in
- 2.45
- What to do
- Update 301 Redirects - Easy Redirect Manager to 2.45 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Aug 30, 2019The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.CVE-2019-15821 · WordPress plugins & themes · reported by MITREHigh 7.5
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
- Product
- bold-page-builder
- Fixed in
- 2.3.2
- What to do
- Update bold-page-builder to 2.3.2 or newer.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Aug 5, 2019The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?actioCVE-2019-14348 · WordPress plugins & themes · reported by MITRECritical 9.8
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter.
- Affected
- 3.3 to 3.3
- What to do
- Affects 3.3 to 3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comhackpuntes.com
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.CVE-2018-20153 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
- Fixed in
- 4.9.9
- What to do
- Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD recordsecurityfocus.comcodex.wordpress.org
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.CVE-2018-20147 · WordPress plugins & themes · reported by MITREMedium 6.5
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
- Fixed in
- 4.9.9
- What to do
- Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD recordsecurityfocus.comcodex.wordpress.org
May 14, 2018Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profileCVE-2018-0590 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors.
- Fixed in
- 2.0.4
- What to do
- Update the plugin to 2.0.4 or newer.
May 22, 2014The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecCVE-2014-3844 · WordPress plugins & themes · reported by MITREMedium 5
The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information.
- Product
- TinyMCE Color Picker
- Fixed in
- 1.2
- What to do
- Update TinyMCE Color Picker to 1.2 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Oct 8, 2012Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute CVE-2012-5318 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the directory specified by the folder parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1125.
- Product
- Kish Guest Posting
- What to do
- Update Kish Guest Posting to the newest version.
Full record and what to do →NVD recordsecunia.comopenwall.com
Oct 8, 2012Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to eCVE-2012-1125 · WordPress plugins & themes · reported by Red HatMedium 6.8
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
- Product
- Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting
- Fixed in
- 1.2
- What to do
- Update Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting to 1.2 or newer.
Full record and what to do →NVD recordarchives.neohapsis.complugins.svn.wordpress.org
Dec 27, 2011Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers toCVE-2011-3841 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.
- Product
- Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium
- Fixed in
- 11.12.08
- What to do
- Update Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium to 11.12.08 or newer.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.