Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

30 results

Oct 15, 2026An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component.CVE-2026-78850 · Other software · reported by MITREMedium 5
An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2026Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expCVE-2026-71285 · Other software · louislam · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.1
Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.
Product
uptime-kuma
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 3, 2025Simple Matomo Tracking Code: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58630 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-code allows Stored XSS.This issue affects Simple Matomo Tracking Code: from n/a through <= 1.1.0.
Product
Simple Matomo Tracking Code
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Simple Matomo Tracking Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 15, 2025An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism.CVE-2025-34104 · Other software · Piwik (now Matomo) · reported by VulnCheckCritical 9.4
An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.
Product
Web Analytics Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record firefart.at matomo.org
Mar 31, 2025Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 befCVE-2025-31680 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.8
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.
Product
Matomo Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Jan 2, 2025Matomo Analytics: Cross-Site Request Forgery (CSRF)CVE-2024-38766 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in matomoteam Matomo Analytics matomo allows Cross Site Request Forgery.This issue affects Matomo Analytics: from n/a through <= 5.1.1.
Product
Matomo Analytics
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Matomo Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 28, 2024Matomo Analytics – Ethical Stats. Powerful Insights.: Reflected Cross-Site ScriptingCVE-2023-6923 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Matomo Analytics – Ethical Stats. Powerful Insights.
Affected
up to 4.15.3
What to do
Affects up to 4.15.3. Update Matomo Analytics – Ethical Stats. Powerful Insights. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2023WP-Matomo Integration (WP-Piwik): Stored Cross-Site ScriptingCVE-2023-4774 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Matomo Integration (WP-Piwik)
Affected
up to 1.0.28
What to do
Affects up to 1.0.28. Update WP-Matomo Integration (WP-Piwik) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2023André Bräkling WP-Matomo Integration: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-33211 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions.
Product
André Bräkling WP-Matomo Integration
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update André Bräkling WP-Matomo Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions.CVE-2023-23659 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions.
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2023A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki.CVE-2017-20175 · Other software · DaSchTour · reported by VulDBLow 2.6
A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.4.3 is able to address this issue. The patch is named 681324e4f518a8af4bd1f93867074c728eb9923d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220203.
Product
matomo-mediawiki-extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 12, 2022The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.CVE-2022-33156 · Other software · Matomo · reported by MITREMedium 6.1
The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.
Product
Integration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Dec 8, 2020The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29578 · Other software · Matomo · reported by MITRECritical 9.8
The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
Product
Piwik Fpm-alpine Docker Image
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 20, 2019A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the diskCVE-2019-12215 · Other software · Matomo · reported by MITREMedium 4.3
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security vulnerabilities.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 16, 2015The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, condCVE-2015-7816 · Other software · Matomo · reported by MITREHigh 7.5
The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery (SSRF) attacks, and execute arbitrary PHP code via a crafted HTTP header.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record karmainsecurity.com packetstormsecurity.com
Nov 16, 2015Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files CVE-2015-7815 · Other software · Matomo · reported by MITREHigh 7.5
Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTable parameter.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record karmainsecurity.com packetstormsecurity.com
Mar 21, 2013Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive inforCVE-2013-2633 · Other software · Matomo · reported by MITREMedium 5
Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record piwik.org piwik.org
Mar 21, 2013Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2013-1844 · Other software · Matomo · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record piwik.org openwall.com
Nov 19, 2012Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2012-4541 · Other software · Matomo · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record piwik.org openwall.com
Sep 18, 2012Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.CVE-2011-4941 · Other software · Matomo · reported by Red HatMedium 6.8
Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record piwik.org openwall.com
Sep 23, 2011Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, CVE-2011-3791 · Other software · Matomo · reported by MITREMedium 5
Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Widgetize/Widgetize.php and certain other files.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com code.google.com
Jan 10, 2011Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode CVE-2011-0401 · Other software · Matomo · reported by MITREMedium 5
Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode consumption) by establishing many sessions.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.piwik.org dev.piwik.org
Jan 10, 2011Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture thCVE-2011-0400 · Other software · Matomo · reported by MITREMedium 5
Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.piwik.org osvdb.org
Jan 10, 2011Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to cCVE-2011-0399 · Other software · Matomo · reported by MITREMedium 4.3
Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.piwik.org osvdb.org
Jan 10, 2011The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocaCVE-2011-0398 · Other software · Matomo · reported by MITREMedium 6.4
The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via (1) use of a private (aka RFC 1918) address behind a proxy server or (2) spoofing of the X-Forwarded-For HTTP header.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.piwik.org osvdb.org
Jan 10, 2011Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2011-0004 · Other software · Matomo · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Aug 2, 2010Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impactCVE-2010-2786 · Other software · Matomo · reported by Red HatMedium 6.8
Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impact via directory traversal sequences in a crafted data-renderer request.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info marc.info
May 7, 2010Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the fCVE-2010-1453 · Other software · Matomo · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record piwik.org secunia.com
Dec 24, 2009The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize functioCVE-2009-4137 · Other software · Matomo · reported by Red HatHigh 7.5
The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the __destruct function in the Piwik_Config class; php://filter URIs; the __destruct functions in Zend Framework, as demonstrated by the Zend_Log destructor; the shutdown functions in Zend Framework, as demonstrated by the Zend_Log_Writer_Mail class; the render function in the Piwik_View class; Smarty templates; and the _eval function in Smarty.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.piwik.org piwik.org
Mar 25, 2009Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key aCVE-2009-1085 · Other software · Matomo · reported by MITREMedium 5
Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.
Product
Matomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.piwik.org marco-ziesing.de

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.