Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

14 results

May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum plugin <= 2.2.0 versions.CVE-2022-41608 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum plugin <= 2.2.0 versions.
Fixed in
2.3.0
What to do
Update the plugin to 2.3.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.CVE-2022-40192 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.CVE-2022-40632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 8, 2022the wpForo Forum plugin <= 2.0.5 on: Insecure direct object references (IDOR)CVE-2022-40206 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.
Product
the wpForo Forum plugin <= 2.0.5 on
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the wpForo Forum plugin <= 2.0.5 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 8, 2022the wpForo Forum plugin <= 2.0.5 on: Insecure direct object references (IDOR)CVE-2022-40205 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved.
Product
the wpForo Forum plugin <= 2.0.5 on
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the wpForo Forum plugin <= 2.0.5 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 9, 2022Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.CVE-2022-38144 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 19, 2019An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress.CVE-2018-16613 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction.
Product
An issue was discovered in the update function in the wpForo Forum
Fixed in
1.5.2
What to do
Update An issue was discovered in the update function in the wpForo Forum to 1.5.2 or newer.
Full record and what to do →NVD record github.com github.com
Jun 4, 2018wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site ScriptinCVE-2018-11709 · WordPress plugins & themes · reported by MITREMedium 6.1
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI.
Product
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum
Fixed in
1.4.12
What to do
Update wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum to 1.4.12 or newer.
Full record and what to do →NVD record blog.dewhurstsecurity.com wordpress.org
Apr 2, 2014Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL cCVE-2013-0735 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comHigh 7.5
Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL commands via the id parameter in a viewtopic (1) remove_post, (2) sticky, or (3) closed action or (4) thread parameter in a postreply action to index.php.
Product
Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum
Fixed in
1.0.34
What to do
Update Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum to 1.0.34 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Mar 28, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web scriptCVE-2013-0734 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) search_words parameter in a search action to wpf.class.php or (2) togroupusers parameter in an add_user_togroup action to fs-admin/fs-admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum
Fixed in
1.0.34
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum to 1.0.34 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Oct 9, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijackCVE-2013-0736 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) modify user privileges or (2) conduct cross-site scripting (XSS) attacks via unspecified vectors.
Product
Mingle Forum
What to do
Update Mingle Forum to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 8, 2012Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated usersCVE-2012-5328 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated users to execute arbitrary SQL commands via the (1) memberid or (2) groupid parameters in a removemember action or (3) id parameter to fs-admin/fs-admin.php, or (4) edit_forum_id parameter in an edit_save_forum action to fs-admin/wpf-edit-forum-group.php.
Product
Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions
Fixed in
1.0.33
What to do
Update Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions to 1.0.33 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 8, 2012Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote CVE-2012-5327 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) delete_usrgrp[] parameter in a delete_usergroups action, (2) usergroup parameter in an add_user_togroup action, or (3) add_forum_group_id parameter in an add_forum_submit action.
Product
Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions
Fixed in
1.0.33
What to do
Update Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions to 1.0.33 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Dec 18, 2009Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the searCVE-2009-3703 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.
Product
Multiple SQL injection vulnerabilities in the WP-Forum
Fixed in
2.4
What to do
Update Multiple SQL injection vulnerabilities in the WP-Forum to 2.4 or newer.
Full record and what to do →NVD record securityfocus.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.