Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

42 results

Oct 23, 2026Hostme v2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112849 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.
Product
Hostme v2
Affected
up to 7.0
What to do
Affects up to 7.0. Update Hostme v2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Hostme v2: Deserialization of Untrusted DataCVE-2026-112848 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
Product
Hostme v2
Affected
up to 7.0
What to do
Affects up to 7.0. Update Hostme v2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 30, 2026FleekDash V2: Authorization bypassCVE-2026-14356 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the email address and password of any WordPress user, including administrators, enabling full account takeover and complete site compromise. The public /wp-json/fleekdash/v1/register endpoint auto-provisions a Subscriber-role account and returns a valid REST nonce regardless of the site's users_can_register setting, enabling unauthenticated attackers to self-provision the required credentials and nonce in a single prior request.
Product
FleekDash V2
Affected
up to 2.6.2.2
What to do
Affects up to 2.6.2.2. Update FleekDash V2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 13, 2026reCAPTCHA (v2 & v3) for Asgaros Forum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 & v3) for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA (v2 & v3) for Asgaros Forum: from n/a through <= 1.1.0.
Product
reCAPTCHA (v2 & v3) for Asgaros Forum
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update reCAPTCHA (v2 & v3) for Asgaros Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.CVE-2026-42629 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Hostme v2: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68907 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through <= 7.0.
Product
Hostme v2
Affected
up to 7.0
What to do
Affects up to 7.0. Update Hostme v2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025WP-CalDav2ICS: Cross-Site Request Forgery (CSRF)CVE-2025-59131 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hoernerfranz WP-CalDav2ICS wp-caldav2ics allows Stored XSS.This issue affects WP-CalDav2ICS: from n/a through <= 1.3.4.
Product
WP-CalDav2ICS
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update WP-CalDav2ICS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 15, 2025Vertical scroll slideshow gallery v2: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49897 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1.
Product
Vertical scroll slideshow gallery v2
Affected
up to 9.1
What to do
Affects up to 9.1. Update Vertical scroll slideshow gallery v2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Naver Syndication V2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26552 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in badrHan Naver Syndication V2 badr-naver-syndication allows Stored XSS.This issue affects Naver Syndication V2: from n/a through <= 0.8.3.
Product
Naver Syndication V2
Affected
up to 0.8.3
What to do
Affects up to 0.8.3. Update Naver Syndication V2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Bootstrap Blocks for WP Editor v2: Stored Cross-Site ScriptingCVE-2024-12495 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bootstrap Blocks for WP Editor v2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtb-bootstrap/column' block in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bootstrap Blocks for WP Editor v2
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Bootstrap Blocks for WP Editor v2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 2, 2024The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.CVE-2024-12015 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 7.7
The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record tenable.com
Jun 12, 2024Newsletter - API v1 and v2 addon: Unauthorized subscribers managementCVE-2024-5674 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0
Product
Newsletter - API v1 and v2 addon
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Newsletter - API v1 and v2 addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record thenewsletterplugin.com wordfence.com
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.CVE-2023-22691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.
Affected
up to 2.1
What to do
Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2022The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints wCVE-2021-25118 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
May 24, 2021The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability.CVE-2021-24305 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com targetfirst.com
Aug 26, 2020Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag.CVE-2020-24314 · WordPress plugins & themes · reported by MITREMedium 6.1
Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org zeroaptitude.com
Aug 14, 2020A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary weCVE-2019-6112 · WordPress plugins & themes · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).
Product
Sell Media
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Sell Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com metamorfosec.com
Mar 9, 2020The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functionCVE-2020-10257 · WordPress plugins & themes · reported by MITRECritical 9.8
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Product
ThemeREX Addons
Fixed in
2020-03-09
What to do
Update ThemeREX Addons to 2020-03-09 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 26, 2019The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.CVE-2019-19542 · WordPress plugins & themes · reported by MITREMedium 5.4
The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.
Product
ListingPro
Fixed in
2.0.14.2
What to do
Update ListingPro to 2.0.14.2 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Dec 26, 2019The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.CVE-2019-19541 · WordPress plugins & themes · reported by MITREMedium 5.4
The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.
Product
ListingPro
Fixed in
2.0.14.2
What to do
Update ListingPro to 2.0.14.2 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Dec 26, 2019The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.CVE-2019-19540 · WordPress plugins & themes · reported by MITREMedium 6.1
The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.
Product
ListingPro
Fixed in
2.0.14.2
What to do
Update ListingPro to 2.0.14.2 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 4, 2019cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_desCVE-2019-14470 · WordPress plugins & themes · reported by MITREMedium 6.1
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
Product
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro
Affected
up to 4.9.32
What to do
Affects up to 4.9.32. Update cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002009 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email variable.
Affected
2.5.1.8 to 2.5.1.8
What to do
Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002008 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variable.
Affected
2.5.1.8 to 2.5.1.8
What to do
Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002007 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id.
Affected
2.5.1.8 to 2.5.1.8
What to do
Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002004 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
Affected
2.5.1.8 to 2.5.1.8
What to do
Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002003 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
Affected
2.5.1.8 to 2.5.1.8
What to do
Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002002 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
Affected
2.5.1.8 to 2.5.1.8
What to do
Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002001 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
Affected
2.5.1.8 to 2.5.1.8
What to do
Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Dec 3, 2018There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit.CVE-2018-1002000 · WordPress plugins & themes · reported by larry0@me.comHigh 7.2
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request.
Affected
2.5.1.8 to 2.5.1.8
What to do
Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Oct 18, 2018The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code inCVE-2018-18461 · WordPress plugins & themes · reported by MITRECritical 9.8
The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments[] data to models/attachment.php.
Affected
2.5.1.7 to 2.5.1.7
What to do
Affects 2.5.1.7 to 2.5.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Sep 7, 2018The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transienCVE-2018-16363 · WordPress plugins & themes · reported by MITREMedium 5.4
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
Affected
2.9 to 2.9
What to do
Affects 2.9 to 2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.51cto.com plugins.trac.wordpress.org
Jun 19, 2018The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.CVE-2018-11526 · WordPress plugins & themes · reported by MITREHigh 7.8
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Dec 27, 2017Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPreCVE-2015-7669 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to "upload file functionality."
Fixed in
1.3.0
What to do
Update the plugin to 1.3.0 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/CVE-2017-1002002 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin photoxhibit v2.1.8CVE-2016-1000144 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin photoxhibit v2.1.8
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin photoxhibit v2.1.8CVE-2016-1000143 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin photoxhibit v2.1.8
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin hero-maps-pro v2.1.0CVE-2016-1000137 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin hero-maps-pro v2.1.0
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin ajax-random-post v2.00CVE-2016-1000127 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin ajax-random-post v2.00
Affected
up to 2.00
What to do
Affects up to 2.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1CVE-2015-1000013 · WordPress plugins & themes · reported by MITREHigh 7.8
Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1
Affected
1.1 to 1.1
What to do
Affects 1.1 to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Blind SQL Injection in wordpress plugin dukapress v2.5.9CVE-2015-1000011 · WordPress plugins & themes · reported by MITRECritical 9.8
Blind SQL Injection in wordpress plugin dukapress v2.5.9
Affected
2.5.9 to 2.5.9
What to do
Affects 2.5.9 to 2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Oct 6, 2016Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2CVE-2015-1000008 · WordPress plugins & themes · reported by MITREMedium 5.3
Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2
Affected
2.3.2 to 2.3.2
What to do
Affects 2.3.2 to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com vapidlabs.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.