Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

481 results · page 10 of 10

Sep 13, 2021WP Courses LMS: Does not sanitise its Video Embed CodeCVE-2021-24621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfiltered_html capability is disallowed, which could lead to Stored Cross-Site Scripting issues
Product
WP Courses LMS
Fixed in
2.0.44
What to do
Update WP Courses LMS to 2.0.44 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021editid GET parameter of the Embed Youtube Video: Is not sanitisedCVE-2021-24395 · WordPress plugins & themes · reported by WPScanHigh 7.2
The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
editid GET parameter of the Embed Youtube Video
Affected
up to 1.0
What to do
Affects up to 1.0. Update editid GET parameter of the Embed Youtube Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 16, 2021Wonder PDF Embed: Does not escape parameters of its wonderplugin_pdf shortcodeCVE-2021-24541 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
Product
Wonder PDF Embed
Fixed in
1.7
What to do
Update Wonder PDF Embed to 1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Wonder Video Embed: Does not escape parameters of its wonderplugin_video shortcodeCVE-2021-24540 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
Product
Wonder Video Embed
Fixed in
1.8
What to do
Update Wonder Video Embed to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021YouTube Embed: Does not validateCVE-2021-24471 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XSS issues by 1. using w, h, controls, cc_lang, color, language, start, stop, or style parameter of youtube shortcode, 2. by using style, class, rel, target, width, height, or alt parameter of youtube_thumb shortcode, or 3. by embedding a video whose title or description contains XSS payload (if API key is configured).
Product
YouTube Embed
Fixed in
5.2.2
What to do
Update YouTube Embed to 5.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021YouTube Embed, Playlist and Popup by WpDevArt: Did not escapeCVE-2021-24464 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue.
Product
YouTube Embed, Playlist and Popup by WpDevArt
Fixed in
2.3.9
What to do
Update YouTube Embed, Playlist and Popup by WpDevArt to 2.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2021The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped beforeCVE-2021-24337 · WordPress plugins & themes · reported by WPScanHigh 8.8
The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
Product
Video Embed
Affected
up to 1.0
What to do
Affects up to 1.0. Update Video Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Apr 12, 2021N5 Upload Form: Suffers from an arbitrary file upload issue in page where a Form from the plugin is embedCVE-2021-24223 · WordPress plugins & themes · reported by WPScanCritical 9.8
The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be uploaded. The uploaded filename might be hard to guess as it's generated with md5(uniqid(rand())), however, in the case of misconfigured servers with Directory listing enabled, accessing it is trivial.
Product
N5 Upload Form
Affected
up to 1.0
What to do
Affects up to 1.0. Update N5 Upload Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
Apr 12, 2021WP-Curriculo Vitae Free: Suffers from an arbitrary file upload issue in page where the [formCadastro] is embedCVE-2021-24222 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.
Product
WP-Curriculo Vitae Free
Affected
up to 6.3
What to do
Affects up to 6.3. Update WP-Curriculo Vitae Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
Nov 2, 2020WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.CVE-2020-28033 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record lists.debian.org lists.fedoraproject.org
Jun 12, 2020In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML CVE-2020-4046 · WordPress plugins & themes · reported by GitHubMedium 5.4
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Dec 4, 2019The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.CVE-2019-19589 · WordPress plugins & themes · reported by MITRECritical 9.8
The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerability reported in PDF Embedder Plugin is not valid as the plugin itself doesn't control or manage the file upload process. It only serves the uploaded PDF files and the responsibility of uploading PDF file remains with the Site owner of Wordpress installation, the upload of PDF file is managed by Wordpress core and not by PDF Embedder Plugin. Control & block of polyglot file is required to be taken care at the time of upload, not on showing the file. Moreover, the reference mentions retrieving the files from the browser cache and manually renaming it to jar for executing the file. That refers to a two step non-connected steps which has nothing to do with PDF Embedder.
Affected
4.4 to 4.4
What to do
Affects 4.4 to 4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sejalivre.org wordpress.org
Aug 27, 2019The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.CVE-2019-15649 · WordPress plugins & themes · reported by MITREHigh 8.8
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
Product
insert-or-embed-articulate-content-into-wordpress
Fixed in
4.2999
What to do
Update insert-or-embed-articulate-content-into-wordpress to 4.2999 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.CVE-2019-15648 · WordPress plugins & themes · reported by MITREMedium 6.5
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
Product
insert-or-embed-articulate-content-into-wordpress
Fixed in
4.29991
What to do
Update insert-or-embed-articulate-content-into-wordpress to 4.29991 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The embed-comment-images plugin before 0.6 for WordPress has XSS.CVE-2017-18561 · WordPress plugins & themes · reported by MITREMedium 6.1
The embed-comment-images plugin before 0.6 for WordPress has XSS.
Product
embed-comment-images
Fixed in
0.6
What to do
Update embed-comment-images to 0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.CVE-2016-10882 · WordPress plugins & themes · reported by MITREHigh 8.8
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
Product
google-document-embedder
Fixed in
2.6.2
What to do
Update google-document-embedder to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The google-document-embedder plugin before 2.6.2 for WordPress has XSS.CVE-2016-10881 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
Product
google-document-embedder
Fixed in
2.6.2
What to do
Update google-document-embedder to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The google-document-embedder plugin before 2.6.1 for WordPress has XSS.CVE-2016-10880 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
Product
google-document-embedder
Fixed in
2.6.1
What to do
Update google-document-embedder to 2.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
May 22, 2019WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/eCVE-2017-6514 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com github.com
Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.CVE-2017-14724 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 11, 2017In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.CVE-2017-6817 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.CVE-2016-5836 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Aug 31, 2015Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators toCVE-2015-6535 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
Product
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed
Fixed in
3.3.3
What to do
Update Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Feb 19, 2015Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script orCVE-2015-1879 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.
Product
Cross-site scripting (XSS) vulnerability in the Google Doc Embedder
Fixed in
2.5.19
What to do
Update Cross-site scripting (XSS) vulnerability in the Google Doc Embedder to 2.5.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 2, 2014SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands CVE-2014-9173 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter.
Product
SQL injection vulnerability in view.php in the Google Doc Embedder
Fixed in
2.5.15
What to do
Update SQL injection vulnerability in view.php in the Google Doc Embedder to 2.5.15 or newer.
Full record and what to do →NVD record osvdb.org security.szurek.pl
May 29, 2014Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-4915 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 5
Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to libs/pdf.php.
Product
Directory traversal vulnerability in the Google Doc Embedder
Fixed in
2.5.4
What to do
Update Directory traversal vulnerability in the Google Doc Embedder to 2.5.4 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Jul 8, 2013WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunctCVE-2013-2202 · WordPress plugins & themes · reported by Red HatMedium 4.3
WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record codex.wordpress.org wordpress.org
Mar 19, 2012The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknoCVE-2012-1786 · WordPress plugins & themes · reported by MITREMedium 5
The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
Product
Media Upload form in the Video Embed & Thumbnail Generator
Fixed in
2.0
What to do
Update Media Upload form in the Video Embed & Thumbnail Generator to 2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 19, 2012kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecifiedCVE-2012-1785 · WordPress plugins & themes · reported by MITREHigh 7.5
kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
Product
kg_callffmpeg.php in the Video Embed & Thumbnail Generator
Fixed in
2.0
What to do
Update kg_callffmpeg.php in the Video Embed & Thumbnail Generator to 2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Mar 1, 2011Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers tCVE-2010-4747 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.
Product
Processing Embed
What to do
Update Processing Embed to the newest version.
Full record and what to do →NVD record secunia.com johnleitch.net
Dec 22, 2010Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2010-4277 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php.
Product
Embedded Video
What to do
Update Embedded Video to the newest version.
Full record and what to do →NVD record securityfocus.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.