Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

34 results

Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.CVE-2026-39540 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.
Affected
up to 1.5.3.2
What to do
Affects up to 1.5.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 20, 2026iTracker360: Cross-Site Request Forgery leading to Stored Cross-Site ScriptingCVE-2026-3572 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in all versions up to and including 2.2.0. This is due to missing nonce verification on the settings form submission and insufficient input sanitization combined with missing output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
iTracker360
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update iTracker360 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2026Affiliate Link Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62077 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SEOSEON EUROPE S.L Affiliate Link Tracker affiliate-link-tracker allows Stored XSS.This issue affects Affiliate Link Tracker: from n/a through <= 0.2.
Product
Affiliate Link Tracker
Affected
up to 0.2
What to do
Affects up to 0.2. Update Affiliate Link Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13073 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
HandL UTM Grabber / Tracker
Fixed in
2.8.1
What to do
Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13072 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
HandL UTM Grabber / Tracker
Fixed in
2.8.1
What to do
Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 26, 2025Referral Link Tracker: Missing AuthorizationCVE-2025-62906 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in epiphanyit321 Referral Link Tracker referral-link-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Referral Link Tracker: from n/a through <= 1.1.4.
Product
Referral Link Tracker
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Referral Link Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WP-Click-Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49954 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mithra62 WP-Click-Tracker wp-click-track allows Reflected XSS.This issue affects WP-Click-Tracker: from n/a through <= 0.7.3.
Product
WP-Click-Tracker
Affected
up to 0.7.3
What to do
Affects up to 0.7.3. Update WP-Click-Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails: SQL InjectionCVE-2025-10047 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails
Affected
up to 5.3.15
What to do
Affects up to 5.3.15. Update Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 20, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: SQL InjectionCVE-2025-10002 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted.
Product
ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025Time Tracker: Unauthorized modification and loss of dataCVE-2025-9018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_function' and 'tt_delete_record_function' functions in all versions up to, and including, 3.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update options such as user registration and default role, allowing anyone to register as an Administrator, and to delete limited data from the database.
Product
Time Tracker
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Time Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2025Goal Tracker for Patreon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48305 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon goal-tracker-for-patreon allows Stored XSS.This issue affects Goal Tracker for Patreon: from n/a through <= 0.4.6.
Product
Goal Tracker for Patreon
Affected
up to 0.4.6
What to do
Affects up to 0.4.6. Update Goal Tracker for Patreon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Shipment Tracker for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24586 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bitsstech Shipment Tracker for Woocommerce shipment-tracker-for-woocommerce allows Reflected XSS.This issue affects Shipment Tracker for Woocommerce: from n/a through <= 1.4.23.
Product
Shipment Tracker for Woocommerce
Affected
up to 1.4.23
What to do
Affects up to 1.4.23. Update Shipment Tracker for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Pro Rank Tracker: Cross-Site Request Forgery (CSRF)CVE-2025-30583 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker proranktracker allows Stored XSS.This issue affects Pro Rank Tracker: from n/a through <= 1.0.0.
Product
Pro Rank Tracker
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Pro Rank Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Facilita Form Tracker: Cross-Site Request Forgery (CSRF)CVE-2025-25128 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in orlandolac Facilita Form Tracker facilita-form-tracker allows Stored XSS.This issue affects Facilita Form Tracker: from n/a through <= 1.0.
Product
Facilita Form Tracker
Affected
up to 1.0
What to do
Affects up to 1.0. Update Facilita Form Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 28, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: Stored Cross-Site ScriptingCVE-2025-0804 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via link titles in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2025Progress Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23892 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Furr Progress Tracker progress-tracker allows DOM-Based XSS.This issue affects Progress Tracker: from n/a through <= 0.9.3.
Product
Progress Tracker
Affected
up to 0.9.3
What to do
Affects up to 0.9.3. Update Progress Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 10, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: Reflected Cross-Site ScriptingCVE-2024-11327 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025Opentracker Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22361 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Opentracker Opentracker Analytics opentracker-analytics allows Reflected XSS.This issue affects Opentracker Analytics: from n/a through <= 1.3.
Product
Opentracker Analytics
Affected
up to 1.3
What to do
Affects up to 1.3. Update Opentracker Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Golf Tracker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51607 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in percent20 Golf Tracker golf-tracker allows SQL Injection.This issue affects Golf Tracker: from n/a through <= 0.7.
Product
Golf Tracker
Affected
up to 0.7
What to do
Affects up to 0.7. Update Golf Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Back Link Tracker: Cross-Site Request Forgery (CSRF)CVE-2024-49617 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in anciwasim Back Link Tracker back-link-tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through <= 1.0.0.
Product
Back Link Tracker
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Back Link Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024Mitm Bug Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49224 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mahesh_9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through <= 1.0.
Product
Mitm Bug Tracker
Affected
up to 1.0
What to do
Affects up to 1.0. Update Mitm Bug Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 8, 2024WP Visitors Tracker: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35737 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3.
Product
WP Visitors Tracker
Affected
up to 2.3
What to do
Affects up to 2.3. Update WP Visitors Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP etracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-etracker WP etracker allows Reflected XSS.This issue affects WP etracker: from n/a through 1.0.2.
Product
WP etracker
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP etracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Credit Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49152 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labs64 Credit Tracker allows Stored XSS.This issue affects Credit Tracker: from n/a through 1.1.17.
Product
Credit Tracker
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update Credit Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2022Plezi: Has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable optionCVE-2022-0680 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue
Product
Plezi
Fixed in
1.0.3
What to do
Update Plezi to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022test parameter of the xmlfeed in the Tradetracker-Store: Is not sanitisedCVE-2021-24778 · WordPress plugins & themes · reported by WPScanHigh 7.2
The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
test parameter of the xmlfeed in the Tradetracker-Store
Fixed in
4.6.60
What to do
Update test parameter of the xmlfeed in the Tradetracker-Store to 4.6.60 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 19, 2022Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.CVE-2021-44777 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 10, 2019The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.CVE-2017-18605 · WordPress plugins & themes · reported by MITRECritical 9.8
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
Product
gravitate-qa-tracker
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update gravitate-qa-tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.CVE-2017-18554 · WordPress plugins & themes · reported by MITREMedium 6.1
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
Product
analytics-tracker
Fixed in
1.1.1
What to do
Update analytics-tracker to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into thCVE-2017-1002007 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts intoCVE-2017-1002006 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the enCVE-2017-1002005 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of aCVE-2017-1002004 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Feb 27, 2014SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress alCVE-2014-1854 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com adrotateplugin.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.