Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38 results
Dec 12, 2025WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint.CVE-2024-58305 · Other software · wondercms · reported by VulnCheckHigh 8.6
WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an authenticated administrator into accessing a malicious link.
- Product
- WonderCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Sep 17, 2025WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality.CVE-2025-57055 · Other software · Wondercms · reported by MITREMedium 6.5
WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curl_exec() without sufficient validation, allowing the attacker to force internal or external HTTP requests.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0.CVE-2025-3123 · Other software · Wondercms · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he philosophy has always been, admin [...] bear responsibility to not install themes/plugins from untrusted sources."
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection CVE-2024-41305 · Other software · wondercms · reported by MITREMedium 4.7
A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file.CVE-2024-41304 · Other software · wondercms · reported by MITREMedium 5.4
An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pCVE-2024-32746 · Other software · wondercms · reported by MITREMedium 4.6
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the MENU parameter under the Menu module.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pCVE-2024-32745 · Other software · wondercms · reported by MITREMedium 5.9
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE DESCRIPTION parameter under the CURRENT PAGE module.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pCVE-2024-32744 · Other software · wondercms · reported by MITREMedium 4.6
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE KEYWORDS parameter under the CURRENT PAGE module.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pCVE-2024-32743 · Other software · wondercms · reported by MITREMedium 5.5
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SITE LANGUAGE CONFIG parameter under the Security module.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Multiple cross-site scripting (XSS) vulnerabilities in the Home page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a craftedCVE-2024-32341 · Other software · Wondercms · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Home page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pCVE-2024-32340 · Other software · wondercms · reported by MITRECritical 9.6
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a craftCVE-2024-32339 · Other software · wondercms · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pCVE-2024-32338 · Other software · wondercms · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE TITLE parameter under the Current Page module.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pCVE-2024-32337 · Other software · wondercms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ADMIN LOGIN URL parameter under the Security module.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests viCVE-2024-27563 · Other software · wondercms · reported by MITREMedium 5.3
A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrCVE-2024-27561 · Other software · wondercms · reported by MITREHigh 8.1
A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the inCVE-2023-41425 · Other software · wondercms · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.
- Product
- wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 17, 2022A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into theCVE-2022-43332 · Other software · Wondercms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability.CVE-2021-42233 · Other software · Simple Blog Project · reported by MITREMedium 5.4
The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. When any user opens a particular blog hosted on an attackers' site, XSS may occur.
- Product
- Simple Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Apr 20, 2021A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a customCVE-2020-35314 · Other software · Wondercms · reported by MITRECritical 9.8
A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Apr 20, 2021A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to exeCVE-2020-35313 · Other software · Wondercms · reported by MITRECritical 9.8
A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Dec 30, 2020WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component.CVE-2020-29469 · Other software · Wondercms · reported by MITREMedium 5.4
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie according to the crafted payload.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 30, 2020WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component.CVE-2020-29233 · Other software · Wondercms · reported by MITREMedium 5.4
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload in the Page description and each time any user will visits the website, the XSS triggers and attacker can steal the cookie according to the crafted payload.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 24, 2020WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel.CVE-2020-29247 · Other software · Wondercms · reported by MITREMedium 4.8
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsystemweakness.comexploit-db.com
Sep 12, 2019Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors.CVE-2019-5956 · Other software · WonderCMS · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors.
- Product
- 2.6.0 and earlier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2018An issue was discovered in WonderCMS before 2.5.2.CVE-2018-14387 · Other software · Wondercms · reported by MITREHigh 8.8
An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated session identifier. The attacker then causes the victim to authenticate against the server using the same session identifier. The attacker can access the user's account through the active session. The Session Fixation attack fixes a session on the victim's browser, so the attack starts before the user logs in.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwondercms.com
Feb 27, 2018In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal.CVE-2018-7172 · Other software · Wondercms · reported by MITREMedium 4.9
In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforeversong.cngithub.com
Feb 9, 2018WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), 'svg' => 'image/svg+xml' that canCVE-2018-1000062 · Other software · Wondercms · reported by MITREMedium 4.4
WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), 'svg' => 'image/svg+xml' that can result in An attacker can execute arbitrary script on an unsuspecting user's browser. This attack appear to be exploitable via Crafted SVG File.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2018WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack.CVE-2017-14523 · Other software · Wondercms · reported by MITREHigh 7.5
WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritywarrior9.blogspot.inexploit-db.com
Jan 26, 2018In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript.CVE-2017-14522 · Other software · Wondercms · reported by MITREMedium 6.1
In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritywarrior9.blogspot.insecuritywarrior9.blogspot.in
Jan 26, 2018In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.CVE-2017-14521 · Other software · Wondercms · reported by MITREHigh 8.8
In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritywarrior9.blogspot.inexploit-db.com
Apr 20, 2017WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context.CVE-2017-7951 · Other software · Wondercms · reported by MITREHigh 8.8
WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwondercms.com
Mar 17, 2017PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameCVE-2014-8705 · Other software · Wondercms · reported by MITRECritical 9.8
PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrossmarks.ukrossmarks.uk
Mar 17, 2017Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.CVE-2014-8704 · Other software · Wondercms · reported by MITRECritical 9.8
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrossmarks.ukrossmarks.uk
Mar 17, 2017Cross-site scripting (XSS) vulnerability in Wonder CMS 2014 allows remote attackers to inject arbitrary web script or HTML.CVE-2014-8703 · Other software · Wondercms · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Wonder CMS 2014 allows remote attackers to inject arbitrary web script or HTML.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrossmarks.ukrossmarks.uk
Mar 17, 2017Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the instalCVE-2014-8702 · Other software · Wondercms · reported by MITREMedium 5.3
Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the installation path in an error message.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrossmarks.ukrossmarks.uk
Mar 17, 2017Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.CVE-2014-8701 · Other software · Wondercms · reported by MITREHigh 7.5
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrossmarks.ukrossmarks.uk
Jan 1, 2015Cross-site scripting (XSS) vulnerability in editText.php in WonderCMS before 0.4 allows remote attackers to inject arbitrary web script or HTML via the content CVE-2011-5317 · Other software · Wondercms · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in editText.php in WonderCMS before 0.4 allows remote attackers to inject arbitrary web script or HTML via the content parameter.
- Product
- Wondercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.