Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

26 results

Aug 28, 2026WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field.CVE-2026-39071 · WordPress plugins & themes · reported by MITREMedium 5.4
WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account.
Fixed in
5.0.9
What to do
Update the plugin to 5.0.9 or newer.
Full record and what to do →NVD record github.com github.com
Dec 24, 2025Spiffy Calendar: Missing AuthorizationCVE-2025-68523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.
Product
Spiffy Calendar
Affected
up to 5.0.7
What to do
Affects up to 5.0.7. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024Spiffy Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43969 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.12.
Product
Spiffy Calendar
Affected
up to 4.9.12
What to do
Affects up to 4.9.12. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45458 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
Product
Spiffy Calendar
Affected
up to 4.9.13
What to do
Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45457 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
Product
Spiffy Calendar
Affected
up to 4.9.13
What to do
Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 22, 2024Spiffy Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38692 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.
Product
Spiffy Calendar
Affected
up to 4.9.11
What to do
Affects up to 4.9.11. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Spiffy Calendar: Missing AuthorizationCVE-2024-30528 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.
Product
Spiffy Calendar
Affected
up to 4.9.10
What to do
Affects up to 4.9.10. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30427 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through 4.9.7.
Product
Spiffy Calendar
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 27, 2024Spiffy Calendar: Doesn't check the event_author parameterCVE-2024-0855 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
Product
Spiffy Calendar
Fixed in
4.9.9
What to do
Update Spiffy Calendar to 4.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 14, 2023Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49745 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through 4.9.5.
Product
Spiffy Calendar
Affected
up to 4.9.5
What to do
Affects up to 4.9.5. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 3, 2023Spiffy Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-46859 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.1.
Product
Spiffy Calendar
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 20, 2022Spiffy Plugins Spiffy Calendar <= 4.9.0 at: Insecure Direct Object References (IDOR)CVE-2022-29434 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.
Product
Spiffy Plugins Spiffy Calendar <= 4.9.0 at
Affected
up to 4.9.0
What to do
Affects up to 4.9.0. Update Spiffy Plugins Spiffy Calendar <= 4.9.0 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).CVE-2022-25599 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).
Affected
up to 4.9.0
What to do
Affects up to 4.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 7, 2017Directory traversal vulnerability in Spiffy before 5.4.CVE-2015-8235 · Other software · Call-cc · reported by MITREHigh 7.5
Directory traversal vulnerability in Spiffy before 5.4.
Product
Spiffy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.call-cc.org openwall.com
Jun 5, 2017Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via theCVE-2017-9420 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.
Product
Cross site scripting (XSS) vulnerability in the Spiffy Calendar
Fixed in
3.3.0
What to do
Update Cross site scripting (XSS) vulnerability in the Spiffy Calendar to 3.3.0 or newer.
Full record and what to do →NVD record spiffycalendar.sunnythemes.com securityfocus.com
Jan 10, 2017The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP_PROXY environment variable, which would allow attackers to direct CGI progrCVE-2016-6286 · Other software · Call-cc · reported by MITREHigh 7.5
The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP_PROXY environment variable, which would allow attackers to direct CGI programs which use this environment variable to use an attacker-specified HTTP proxy server (also known as a "httpoxy" attack). This affects all versions of spiffy-cgi-handlers before 0.5.
Product
Http-client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.gnu.org securityfocus.com
May 10, 2013SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via theCVE-2013-3530 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
Product
Spiffy XSPF Player
What to do
Update Spiffy XSPF Player to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jun 30, 2006SQL injection vulnerability in includes/functions_logging.php in phpRaid 3.0.5, and possibly other versions, allows remote attackers to execute arbitrary SQL coCVE-2006-3322 · Other software · Spiffyjr · reported by MITREMedium 5.1
SQL injection vulnerability in includes/functions_logging.php in phpRaid 3.0.5, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the log_hack function.
Product
Phpraid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Jun 29, 2006SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to exCVE-2006-3318 · Other software · Spiffyjr · reported by PSIRT-CNA@flexerasoftware.comMedium 5.1
SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) email parameters.
Product
Phpraid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Jun 29, 2006Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (CVE-2006-3316 · Other software · Spiffyjr · reported by PSIRT-CNA@flexerasoftware.comMedium 5.1
Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) logs.php and (2) users.php, a different set of vectors than CVE-2006-3116.
Product
Phpraid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Jun 29, 2006SQL injection vulnerability in view.php in phpRaid 3.0.4, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the raid_idCVE-2006-3115 · Other software · Spiffyjr · reported by PSIRT-CNA@flexerasoftware.comMedium 5.1
SQL injection vulnerability in view.php in phpRaid 3.0.4, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the raid_id parameter.
Product
Phpraid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Jun 29, 2006Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.4 and 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraid_dir paraCVE-2006-3116 · Other software · Spiffyjr · reported by PSIRT-CNA@flexerasoftware.comMedium 5.1
Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.4 and 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) configuration.php, (3) guilds.php, (4) index.php, (5) locations.php, (6) login.php, (7) lua_output.php, (8) permissions.php, (9) profile.php, (10) raids.php, (11) register.php, (12) roster.php, and (13) view.php.
Product
Phpraid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Jun 29, 2006PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) announcCVE-2006-3317 · Other software · Spiffyjr · reported by PSIRT-CNA@flexerasoftware.comMedium 5.1
PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) announcements.php and (2) rss.php, a different set of vectors and affected versions than CVE-2006-3316 and CVE-2006-3116.
Product
Phpraid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
May 25, 2006Cross-site scripting (XSS) vulnerability in view.php in phpRaid 2.9.5 allows remote attackers to inject arbitrary web script or HTML via the (1) URL query strinCVE-2006-2610 · Other software · Spiffyjr · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in view.php in phpRaid 2.9.5 allows remote attackers to inject arbitrary web script or HTML via the (1) URL query string and the (2) Sort parameter.
Product
Phpraid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securityfocus.com
May 9, 2006Multiple PHP remote file inclusion vulnerabilities in SpiffyJr phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP code via a URL in thCVE-2006-2283 · Other software · Spiffyjr · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in SpiffyJr phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) auth.php and (2) auth_phpbb when the phpBB portal is enabled, and via a URL in the smf_root_path parameter in (3) auth.php and (4) auth_SMF when the SMF portal is enabled.
Product
Phpraid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Jan 24, 2006Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbCVE-2006-0224 · Other software · Libast · reported by MITREMedium 4.6
Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long -X command line argument (alternative configuration file name).
Product
Libast
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record freshmeat.net secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.