Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40 results
Jan 13, 2026WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel.CVE-2022-50936 · Other software · Wbce · reported by VulnCheckHigh 8.7
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by crafting a specially designed zip file payload.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags CVE-2023-53910 · Other software · wbce-cms · reported by VulnCheckMedium 5.1
WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with malicious script content in the content parameter to execute JavaScript when users view the affected page.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwbce-cms.orgexploit-db.com
Dec 17, 2025WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG CVE-2023-53909 · Other software · wbce-cms · reported by VulnCheckMedium 5.1
WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the /wbce/modules/elfinder/ef/php/connector.wbce.php endpoint and execute JavaScript when victims access the uploaded file.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwbce-cms.orgexploit-db.com
Dec 16, 2025WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes.CVE-2023-53901 · Other software · Unknown · reported by VulnCheckHigh 7.1
WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can upload a crafted HTML file with CSS-based keylogging techniques to intercept password characters through background image requests.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwbce-cms.orgexploit-db.com
Dec 11, 2025WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules.CVE-2025-34506 · Other software · WBCE · reported by VulnCheckHigh 8.6
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder filCVE-2024-58283 · Other software · wbce · reported by VulnCheckHigh 8.7
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwbce-cms.org
Dec 10, 2025WBCE CMS is a content management system.CVE-2025-65950 · Other software · WBCE · reported by GitHubCritical 9.4
WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise, data exfiltration, effectively bypassing all security controls. The vulnerability exists in the admin/users/save.php script, which handles updates to user profiles. The script improperly processes the groups[] parameter sent from the user edit form. This issue is fixed in version 1.6.5.
- Product
- WBCE_CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025WBCE CMS is a content management system.CVE-2025-67504 · Other software · WBCE · reported by GitHubCritical 9.1
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
- Product
- WBCE_CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Dec 8, 2025WBCE CMS is a content management system.CVE-2025-66204 · Other software · WBCE · reported by GitHubMedium 6.3
WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5.
- Product
- WBCE_CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025WBCE CMS is a content management system.CVE-2025-65094 · Other software · WBCE · reported by GitHubHigh 8.7
WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups[] parameter in the /admin/users/save.php request. The UI restricts users to assigning only their existing group, but server-side validation is missing, allowing attackers to overwrite their group membership and obtain full administrative access. This results in a complete compromise of the CMS. This issue has been patched in version 1.6.4.
- Product
- WBCE_CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE CVE-2023-39796 · Other software · Wbce · reported by MITRECritical 9.8
SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.wbce.orggithub.com
Oct 21, 2023Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footCVE-2023-46054 · Other software · Wbce · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the admin/settings/save.php component.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).CVE-2023-43871 · Other software · Wbce · reported by MITREMedium 5.4
A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP fCVE-2023-38947 · Other software · wbce · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- wbce_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.CVE-2023-29855 · Other software · Wbce · reported by MITREHigh 7.2
WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.CVE-2022-46020 · Other software · Wbce · reported by MITRECritical 9.8
WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a CVE-2022-45040 · Other software · Wbce · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-45039 · Other software · Wbce · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafteCVE-2022-45038 · Other software · Wbce · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted CVE-2022-45037 · Other software · Wbce · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafCVE-2022-45036 · Other software · Wbce · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the No Results field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML viaCVE-2022-45017 · Other software · Wbce · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Loop field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafCVE-2022-45016 · Other software · Wbce · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Footer field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafCVE-2022-45015 · Other software · Wbce · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Results Footer field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafCVE-2022-45014 · Other software · Wbce · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Results Header field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via aCVE-2022-45013 · Other software · Wbce · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Section Header field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted CVE-2022-45012 · Other software · Wbce · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Source field.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A vulnerability, which was classified as problematic, has been found in WBCE CMS.CVE-2022-4006 · Other software · WBCE · reported by VulDBLow 3.7
A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The name of the patch is d394ba39a7bfeb31eda797b6195fd90ef74b2e75. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213716.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters.CVE-2022-30072 · Other software · Wbce · reported by MITREMedium 5.4
WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.CVE-2022-30073 · Other software · Wbce · reported by MITREMedium 5.4
WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).CVE-2022-28477 · Other software · Wbce · reported by MITREMedium 6.1
WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-25101 · Other software · Wbce · reported by MITREHigh 7.8
A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-25099 · Other software · Wbce · reported by MITREHigh 7.8
A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2021wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL CommandCVE-2021-3817 · Other software · wbce · reported by security@huntr.devCritical 9.8
wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
- Product
- wbce/wbce_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 14, 2019A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier.CVE-2019-17575 · Other software · Wbce · reported by MITREHigh 7.2
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .jpg file, and then change the file's base name to filename.ph and change the file's extension to p. Because of concatenation, the name is then treated as filename.php.) At the result, remote attackers can execute arbitrary PHP code.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2018Cross-site scripting (XSS) in WBCE CMS 1.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the Modify Page screen, a difCVE-2018-6313 · Other software · Wbce · reported by MITREMedium 4.8
Cross-site scripting (XSS) in WBCE CMS 1.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the Modify Page screen, a different issue than CVE-2017-2118.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=user_searchCVE-2017-1000213 · Other software · Wbce · reported by MITREMedium 4.8
WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=user_search
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2017SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectoCVE-2017-2120 · Other software · WBCE Team · reported by vultures@jpcert.or.jpHigh 7.2
SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.CVE-2017-2119 · Other software · WBCE Team · reported by vultures@jpcert.or.jpHigh 8.6
Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2017-2118 · Other software · WBCE Team · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.