Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Oct 9, 2026Shipping for Nova Poshta: Does not perform any authorisationCVE-2026-87846 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.
- Product
- Shipping for Nova Poshta
- Affected
- up to 1.19.8
- What to do
- Affects up to 1.19.8. Update Shipping for Nova Poshta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer.CVE-2026-73506 · Other software · JanDeDobbeleer · reported by GitHubMedium 6.1
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.
- Product
- oh-my-posh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer.CVE-2026-73505 · Other software · JanDeDobbeleer · reported by GitHubHigh 7.8
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.
- Product
- oh-my-posh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing asCVE-2024-53304 · Other software · reported by MITREMedium 6.5
An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing as an infected machine.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025A remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated attackers to execute CVE-2024-53303 · Other software · reported by MITREHigh 8.8
A remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated attackers to execute arbitrary code via a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Shipping for Nova Poshta: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24612 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through <= 1.19.6.
- Product
- Shipping for Nova Poshta
- Affected
- up to 1.19.6
- What to do
- Affects up to 1.19.6. Update Shipping for Nova Poshta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Woo Ukrposhta: Reflected Cross-Site ScriptingCVE-2024-12049 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order', 'post', and 'idd' parameters in all versions up to, and including, 1.17.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Woo Ukrposhta
- Affected
- up to 1.17.11
- What to do
- Affects up to 1.17.11. Update Woo Ukrposhta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 22, 2024Language Switcher for Transposh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Gasi Language Switcher for Transposh allows Reflected XSS.This issue affects Language Switcher for Transposh: from n/a through 1.5.9.
- Product
- Language Switcher for Transposh
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update Language Switcher for Transposh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2022Transposh WordPress Translation: Unauthorized setting changes by unauthenticated usersCVE-2022-2536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.9.6
- What to do
- Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Sep 6, 2022Transposh WordPress Translation: Sensitive information disclosure to unauthenticated usersCVE-2022-2462 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.9.6
- What to do
- Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Sep 6, 2022Transposh WordPress Translation: Unauthorized setting changes by unauthenticated usersCVE-2022-2461 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.9.6
- What to do
- Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Aug 22, 2022Transposh WordPress Translation: Does not validate its debug settingsCVE-2022-25812 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the order and orderby parameters before using them in a SQL statementCVE-2022-25811 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Transposh WordPress Translation: Exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/adminCVE-2022-25810 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and backup/restore operations.
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Transposh WordPress Translation: Does not have CSRF check in its tp_translation AJAX actionCVE-2021-24912 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in admin
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the tk0 parameter from the tp_translation AJAX actionCVE-2021-24911 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated usersCVE-2021-24910 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Nov 22, 2019Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web scripCVE-2014-2214 · Other software · Posh Project · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to portal/openrssarticle.php
- Product
- Posh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsysdream.com
Nov 22, 2019Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and cCVE-2014-2213 · Other software · Posh Project · reported by MITREMedium 6.1
Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to portal/scr_sendmd5.php.
- Product
- Posh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Apr 1, 2014The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of tCVE-2014-2212 · Other software · Posh Project · reported by MITREMedium 5
The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie.
- Product
- Posh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsysdream.com
Mar 3, 2014SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute arbitrary SCVE-2014-2211 · Other software · Posh Project · reported by MITREHigh 7.5
SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter.
- Product
- Posh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsourceforge.net
Dec 14, 2011Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary filCVE-2011-4832 · Other software · Caupo · reported by MITREHigh 7.5
Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter in a template action.
- Product
- Cauposhop Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Jun 25, 2008SQL injection vulnerability in csc_article_details.php in Caupo.net CaupoShop Classic 1.3 allows remote attackers to execute arbitrary SQL commands via the saArCVE-2008-2866 · Other software · Caupo.net · reported by MITREHigh 7.5
SQL injection vulnerability in csc_article_details.php in Caupo.net CaupoShop Classic 1.3 allows remote attackers to execute arbitrary SQL commands via the saArticle[ID] parameter.
- Product
- Cauposhop Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Nov 1, 2007PHP remote file inclusion vulnerability in index.php in CaupoShop Pro 2.x allows remote attackers to execute arbitrary PHP code via a URL in the action parameteCVE-2007-5784 · Other software · Caupo.net · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in index.php in CaupoShop Pro 2.x allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.
- Product
- Cauposhop Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comvupen.com
Jul 26, 2002Cross-site scripting vulnerability in CaupoShop 1.30a and earlier, and possibly CaupoShopPro, allows remote attackers to execute arbitrary Javascript and steal CVE-2002-0439 · Other software · Caupo.net · reported by MITREHigh 7.5
Cross-site scripting vulnerability in CaupoShop 1.30a and earlier, and possibly CaupoShopPro, allows remote attackers to execute arbitrary Javascript and steal credit card numbers or delete items by injecting the script into new customer information fields such as the message field.
- Product
- Cauposhop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiss.netsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.