Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

61 results · page 1 of 2

Oct 2, 2026OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: Does not require authentication or a valid nonce on an action that issues a slow server-side loopback requestCVE-2026-91828 · WordPress plugins & themes · reported by WPScanHigh 7.5
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.
Product
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Fixed in
6.3.11
What to do
Update OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. to 6.3.11 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026WP OAuth Server ( Login with WordPress ): Does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchangedCVE-2026-82843 · WordPress plugins & themes · reported by WPScanCritical 9
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.
Product
WP OAuth Server ( Login with WordPress )
Fixed in
6.4.0
What to do
Update WP OAuth Server ( Login with WordPress ) to 6.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026Ultimate Gift Cards for WooCommerce: Does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkoutCVE-2026-19436 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.
Product
Ultimate Gift Cards for WooCommerce
Fixed in
3.2.10
What to do
Update Ultimate Gift Cards for WooCommerce to 3.2.10 or newer.
Full record and what to do →NVD record wpscan.com
Dec 6, 2021The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcCVE-2021-25041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action
Product
Photo Gallery by 10Web
Fixed in
1.5.68
What to do
Update Photo Gallery by 10Web to 1.5.68 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
May 14, 2021Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_idCVE-2021-24291 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Fixed in
1.5.69
What to do
Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to 1.5.69 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from Cross-Site Request Forgery issuesCVE-2021-24178 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing an attacker to make a logged in administrator add, edit or delete form fields, which could also lead to Stored Cross-Site Scripting issues.
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11.1
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 22, 2021Cooked Pro: Was affected by unauthenticated reflected Cross-Site Scripting issuesCVE-2021-24233 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
Product
Cooked Pro
Fixed in
1.7.5.6
What to do
Update Cooked Pro to 1.7.5.6 or newer.
Full record and what to do →NVD record wpscan.com getastra.com
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.CVE-2019-17231 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
Product
includes/theme-functions.php in the OneTone
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Nov 26, 2019The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, andCVE-2015-9537 · WordPress plugins & themes · reported by MITREMedium 5.4
The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.
Product
NextGEN Gallery
Fixed in
2.1.10
What to do
Update NextGEN Gallery to 2.1.10 or newer.
Full record and what to do →NVD record cybersecurityworks.com github.com
Oct 22, 2019The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.CVE-2015-9493 · WordPress plugins & themes · reported by MITREMedium 6.1
The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.
Product
my-wish-list
Fixed in
1.4.2
What to do
Update my-wish-list to 1.4.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 10, 2019The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.CVE-2017-18608 · WordPress plugins & themes · reported by MITREMedium 6.1
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
Product
spotim-comments
Fixed in
4.0.4
What to do
Update spotim-comments to 4.0.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.CVE-2017-18590 · WordPress plugins & themes · reported by MITREMedium 6.1
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
Product
timesheet
Fixed in
0.1.5
What to do
Update timesheet to 0.1.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.CVE-2017-18582 · WordPress plugins & themes · reported by MITREMedium 6.1
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
Product
time-sheets
Fixed in
1.5.2
What to do
Update time-sheets to 1.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.CVE-2017-18575 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
Product
newstatpress
Fixed in
1.2.5
What to do
Update newstatpress to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.CVE-2018-20970 · WordPress plugins & themes · reported by MITREMedium 6.1
The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
Product
pdf-print
Fixed in
2.0.3
What to do
Update pdf-print to 2.0.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.CVE-2017-18562 · WordPress plugins & themes · reported by MITREMedium 6.1
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
Product
error-log-viewer
Fixed in
1.0.6
What to do
Update error-log-viewer to 1.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.CVE-2017-18559 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
Product
cforms2
Fixed in
14.13.3
What to do
Update cforms2 to 14.13.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18516 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
bws-linkedin
Fixed in
1.0.5
What to do
Update bws-linkedin to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The sender plugin before 1.2.1 for WordPress has multiple XSS issues.CVE-2017-18564 · WordPress plugins & themes · reported by MITREMedium 6.1
The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
Product
sender
Fixed in
1.2.1
What to do
Update sender to 1.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.CVE-2016-10911 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
Product
profile-builder
Fixed in
2.4.2
What to do
Update profile-builder to 2.4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.CVE-2016-10910 · WordPress plugins & themes · reported by MITREMedium 6.1
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
Product
formbuilder
Fixed in
1.06
What to do
Update formbuilder to 1.06 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-10380 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
Product
profile-builder
Fixed in
1.1.66
What to do
Update profile-builder to 1.1.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The updater plugin before 1.35 for WordPress has multiple XSS issues.CVE-2017-18565 · WordPress plugins & themes · reported by MITREMedium 6.1
The updater plugin before 1.35 for WordPress has multiple XSS issues.
Product
updater
Fixed in
1.35
What to do
Update updater to 1.35 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.CVE-2017-18558 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
Product
bws-testimonials
Fixed in
0.1.9
What to do
Update bws-testimonials to 0.1.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.CVE-2017-18557 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
Product
bws-google-maps
Fixed in
1.3.6
What to do
Update bws-google-maps to 1.3.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.CVE-2017-18556 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
Product
bws-google-analytics
Fixed in
1.7.1
What to do
Update bws-google-analytics to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.CVE-2017-18537 · WordPress plugins & themes · reported by MITREMedium 6.1
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
Product
visitors-online
Fixed in
1.0.0
What to do
Update visitors-online to 1.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.CVE-2016-10897 · WordPress plugins & themes · reported by MITREMedium 6.1
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
Product
sermon-browser
Fixed in
0.45.16
What to do
Update sermon-browser to 0.45.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.CVE-2017-18566 · WordPress plugins & themes · reported by MITREMedium 6.1
The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
Product
user-role
Fixed in
1.5.6
What to do
Update user-role to 1.5.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The realty plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18532 · WordPress plugins & themes · reported by MITREMedium 6.1
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
realty
Fixed in
1.1.0
What to do
Update realty to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.CVE-2017-18530 · WordPress plugins & themes · reported by MITREMedium 6.1
The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
Product
rating-bws
Fixed in
0.2
What to do
Update rating-bws to 0.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.CVE-2017-18529 · WordPress plugins & themes · reported by MITREMedium 6.1
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
Product
promobar
Fixed in
1.1.1
What to do
Update promobar to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.CVE-2017-18528 · WordPress plugins & themes · reported by MITREMedium 6.1
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
Product
pdf-print
Fixed in
1.9.4
What to do
Update pdf-print to 1.9.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.CVE-2017-18527 · WordPress plugins & themes · reported by MITREMedium 6.1
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
Product
pagination
Fixed in
1.0.7
What to do
Update pagination to 1.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.CVE-2017-18524 · WordPress plugins & themes · reported by MITREMedium 6.1
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
Product
football-pool
Fixed in
2.6.5
What to do
Update football-pool to 2.6.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18518 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
bws-smtp
Fixed in
1.1.0
What to do
Update bws-smtp to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.CVE-2016-10892 · WordPress plugins & themes · reported by MITREMedium 6.1
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
Product
chained-quiz
Fixed in
1.0
What to do
Update chained-quiz to 1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18517 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
bws-pinterest
Fixed in
1.0.5
What to do
Update bws-pinterest to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.CVE-2016-10893 · WordPress plugins & themes · reported by MITREMedium 6.1
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
Product
crayon-syntax-highlighter
Fixed in
2.8.4
What to do
Update crayon-syntax-highlighter to 2.8.4 or newer.
Full record and what to do →NVD record github.com github.com
Aug 16, 2019The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18542 · WordPress plugins & themes · reported by MITREMedium 6.1
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
zendesk-help-center
Fixed in
1.0.5
What to do
Update zendesk-help-center to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.CVE-2016-10888 · WordPress plugins & themes · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.7
What to do
Update all-in-one-wp-security-and-firewall to 4.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.CVE-2016-10887 · WordPress plugins & themes · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.9
What to do
Update all-in-one-wp-security-and-firewall to 4.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.CVE-2016-10884 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Product
simple-membership
Fixed in
3.3.3
What to do
Update simple-membership to 3.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.CVE-2015-9310 · WordPress plugins & themes · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.1
What to do
Update all-in-one-wp-security-and-firewall to 3.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.CVE-2017-18488 · WordPress plugins & themes · reported by MITREMedium 6.1
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
Product
Backup Guard
Fixed in
1.1.47
What to do
Update Backup Guard to 1.1.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.CVE-2017-18487 · WordPress plugins & themes · reported by MITREMedium 6.1
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
Product
adsense-plugin (aka Google AdSense)
Fixed in
1.44
What to do
Update adsense-plugin (aka Google AdSense) to 1.44 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.CVE-2016-10866 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.2.0
What to do
Update all-in-one-wp-security-and-firewall to 4.2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.CVE-2017-18496 · WordPress plugins & themes · reported by MITREMedium 6.1
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
Product
htaccess
Fixed in
1.7.6
What to do
Update htaccess to 1.7.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.CVE-2017-18494 · WordPress plugins & themes · reported by MITREMedium 6.1
The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
Product
custom-search-plugin
Fixed in
1.36
What to do
Update custom-search-plugin to 1.36 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.CVE-2017-18493 · WordPress plugins & themes · reported by MITREMedium 6.1
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
Product
custom-admin-page
Fixed in
0.1.2
What to do
Update custom-admin-page to 0.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.