Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Nov 2, 2020WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.CVE-2020-28033 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Feb 25, 2020The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.CVE-2020-9019 · WordPress plugins & themes · reported by MITREMedium 6.1
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
- Affected
- 5.5.3 to 5.5.3
- What to do
- Affects 5.5.3 to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcert.ikiu.ac.iruploadboy.com
Jan 2, 2020The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.CVE-2019-20204 · WordPress plugins & themes · reported by MITREMedium 5.4
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
- Affected
- up to 1.9.40
- What to do
- Affects up to 1.9.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 13, 2019The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= CVE-2019-12516 · WordPress plugins & themes · reported by MITREHigh 8.8
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI.
- Product
- slickquiz
- Affected
- up to 1.3.7.1
- What to do
- Affects up to 1.3.7.1. Update slickquiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 9, 2019The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath toCVE-2018-21013 · WordPress plugins & themes · reported by MITRECritical 9.8
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.
- Product
- Swape
- Fixed in
- 1.2.1
- What to do
- Update Swape to 1.2.1 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Sep 3, 2019The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] paramCVE-2019-15889 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
- Product
- download-manager
- Fixed in
- 2.9.94
- What to do
- Update download-manager to 2.9.94 or newer.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
- Product
- admin/includes/class.import.snippet.php in the "Woody ad snippets
- Fixed in
- 2.2.5
- What to do
- Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD recordblog.nintechnet.comwpvulndb.com
Aug 9, 2019The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated byCVE-2016-10865 · WordPress plugins & themes · reported by MITREMedium 6.1
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
- Product
- Lightbox Plus Colorbox
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Lightbox Plus Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Jul 11, 2019The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.CVE-2019-13505 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
- Affected
- 1.1.44 to 1.1.44
- What to do
- Affects 1.1.44 to 1.1.44. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
May 13, 2019The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstratCVE-2019-11886 · WordPress plugins & themes · reported by MITREHigh 8.8
The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.
- Product
- WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer)
- Fixed in
- 7.2.1
- What to do
- Update WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) to 7.2.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
May 30, 2018Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter.CVE-2018-11568 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the '<' and '>' characters have < and > representations.
- Product
- Reflected XSS is possible in the GamePlan
- Affected
- up to 1.5.13.2
- What to do
- Affects up to 1.5.13.2. Update Reflected XSS is possible in the GamePlan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 14, 2018A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode paCVE-2018-8711 · WordPress plugins & themes · reported by MITRECritical 9.8
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.
- Product
- A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF)
- Fixed in
- 2.2.0
- What to do
- Update A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD recordsec-consult.comwordpress.org
Mar 14, 2018A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode pCVE-2018-8710 · WordPress plugins & themes · reported by MITRECritical 9.8
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.
- Product
- A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF)
- Fixed in
- 2.2.0
- What to do
- Update A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD recordsec-consult.comwordpress.org
Sep 17, 2017WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstraCVE-2017-14530 · WordPress plugins & themes · reported by MITREHigh 8
WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences.
- Product
- WP_Admin_UI in the Crony Cronjob Manager
- Fixed in
- 0.4.7
- What to do
- Update WP_Admin_UI in the Crony Cronjob Manager to 0.4.7 or newer.
Full record and what to do →NVD recordcybersecurityworks.comgithub.com
Aug 1, 2017The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More TCVE-2017-12131 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.
- Affected
- 3.0.4 to 3.0.4
- What to do
- Affects 3.0.4 to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.