Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
30 results
Sep 22, 2026CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not sCVE-2026-88418 · Other software · reported by MITREHigh 8.8
CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the csrf_token hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an unauthenticated attacker can induce a logged-in administrator's browser to issue a forged content-save request with a text payload containing a scripting marker. The marker is stored verbatim into content/content.php; on every subsequent page view evaluate_cmsimple_scripting() (functions.php) executes the marker body with PHP eval() — for all visitors, including unauthenticated ones. This yields persistent remote code execution on the web server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin.CVE-2026-78834 · Other software · reported by MITREHigh 8.8
A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing crafted external or uploaded text content through the affected content import feature.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 23, 2025CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload CVE-2021-47736 · Other software · Cmsimple-Xh · reported by VulnCheckHigh 8.6
CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file that enables arbitrary command execution on the server.
- Product
- CMSimple_XH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmsimple-xh.orgexploit-db.com
Dec 23, 2025CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files.CVE-2021-47735 · Other software · Cmsimple · reported by VulnCheckHigh 8.6
CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF token.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmsimple.orgexploit-db.com
Dec 23, 2025CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary codCVE-2021-47734 · Other software · Cmsimple · reported by VulnCheckHigh 8.6
CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.
- Product
- CMSimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmsimple.orgexploit-db.com
Dec 23, 2025CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding.CVE-2021-47733 · Other software · Cmsimple · reported by VulnCheckMedium 5.1
CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like ')-alert(1)// and execute arbitrary JavaScript when victims interact with delete buttons.
- Product
- CMSimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmsimple.orgexploit-db.com
Dec 23, 2025CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript.CVE-2021-47732 · Other software · CMSimple · reported by VulnCheckMedium 5.1
CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.
- Product
- CMSimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmsimple.orgexploit-db.com
Dec 10, 2025CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files.CVE-2024-58280 · Other software · CMSimple · reported by VulnCheckHigh 8.6
CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensions_userfiles and upload a shell script to the media directory to execute arbitrary code on the server.
- Product
- CMSimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmsimple.orgcmsimple.org
Nov 6, 2025A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inseCVE-2025-63589 · Other software · Cmsimple-xh · reported by MITREHigh 7.1
A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims' browsers visiting a crafted URL.
- Product
- Cmsimple XH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaCVE-2025-63588 · Other software · Cmsimple-xh · reported by MITREHigh 7.1
An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a maliciously crafted POST login). Successful exploitation may lead to theft of session cookies, credential disclosure, or other client-side impacts.
- Product
- Cmsimple XH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhelloandrewpaul.medium.com
Jan 27, 2025CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request.CVE-2024-57549 · Other software · Cmsimple · reported by MITREHigh 7.5
CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 27, 2025CMSimple 5.16 allows the user to edit log.php file via print page.CVE-2024-57548 · Other software · Cmsimple · reported by MITRECritical 9.1
CMSimple 5.16 allows the user to edit log.php file via print page.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 27, 2025Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the Functionality of downCVE-2024-57547 · Other software · Cmsimple · reported by MITREHigh 7.5
Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the Functionality of downloading php backup files.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 27, 2025An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function.CVE-2024-57546 · Other software · Cmsimple · reported by MITREHigh 7.5
An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 21, 2024CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document.CVE-2024-34452 · Other software · cmsimple-xh · reported by MITREMedium 6.1
CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document.
- Product
- cmsimple_xh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload CVE-2024-33423 · Other software · cmsimple · reported by MITREHigh 7.4
Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section.
- Product
- cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2024-33424 · Other software · cmsimple · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section.
- Product
- cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component.CVE-2024-32392 · Other software · cmsimple · reported by MITREMedium 4.5
Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component.
- Product
- cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2024-32345 · Other software · cmsimple · reported by MITREHigh 7.2
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Configuration parameter under the Language section.
- Product
- cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2024-32344 · Other software · cmsimple · reported by MITREMedium 6.8
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit parameter under the Language section.
- Product
- cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability.CVE-2021-42645 · Other software · Cmsimple-xh · reported by MITRECritical 10
CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker must use the "File" parameter to upload a PHP payload to get a reverse shell from the vulnerable host.
- Product
- Cmsimple XH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022CMSimple 5.4 is vulnerable to Directory Traversal.CVE-2021-43741 · Other software · Cmsimple · reported by MITRECritical 9.8
CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature.CVE-2021-43742 · Other software · Cmsimple · reported by MITREMedium 5.4
CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2018CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI.CVE-2018-19508 · Other software · Cmsimple · reported by MITREMedium 4.8
CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2018CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.CVE-2018-19507 · Other software · Cmsimple · reported by MITREMedium 4.8
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2014Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remotCVE-2014-2219 · Other software · Cmsimple · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter.
- Product
- Cmsimple Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jun 10, 2008Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrarCVE-2008-2650 · Other software · Cmsimple · reported by MITREMedium 6.8
Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.
- Product
- Cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2007Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the senCVE-2007-0610 · Other software · Cmsmadesimple · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2007Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1)CVE-2007-0551 · Other software · Cmsmadesimple · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityreason.com
Jul 27, 2005Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchCVE-2005-2392 · Other software · Cmsmadesimple · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlostmon.blogspot.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.