Updated 16 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

511new WordPress flaws this week

392,772entries in the database

5,780 results · page 107 of 116

Oct 27, 2014Multiple cross-site scripting (XSS) vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remote attackers to inject arbitrary web scripCVE-2014-4586 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the league parameter to (1) football_classification.php, (2) football_criteria.php, (3) templates/template_default_preview.php, or (4) templates/template_worldCup_preview.php; the (5) f parameter to football-functions.php; the id parameter in an "action" action to (6) football_groups_list.php, (7) football_matches_list.php, (8) football_matches_phase.php, or (9) football_phases_list.php; or the (10) id_league parameter in a delete action to football_matches_load.php.
Product
wp-football
Affected
up to 1.1
What to do
Affects up to 1.1. Update wp-football to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Oct 24, 2014WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-FCVE-2014-6230 · WordPress plugins & themes · reported by MITREMedium 4.3
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.
Product
WP-Ban
Fixed in
1.6.4
What to do
Update WP-Ban to 1.6.4 or newer.
Full record and what to do →NVD record seclists.org security.dxw.com
Oct 22, 2014Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web scriCVE-2014-7182 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the poly_id parameter in an (1) edit_poly, (2) edit_polyline, or (3) edit_marker action in the wp-google-maps-menu page to wp-admin/admin.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps
Fixed in
6.0.27
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps to 6.0.27 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 21, 2014Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackersCVE-2014-4577 · WordPress plugins & themes · reported by MITREMedium 5
Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.
Product
WP AmASIN - The Amazon Affiliate Shop
Affected
up to 0.9.6
What to do
Affects up to 0.9.6. Update WP AmASIN - The Amazon Affiliate Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com plugins.svn.wordpress.org
Oct 21, 2014Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inCVE-2014-4517 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the searchString parameter.
Product
CBI Referral Manager
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update CBI Referral Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Oct 21, 2014Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackeCVE-2014-4514 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function.
Product
Alipay
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Alipay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Oct 21, 2014SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commandsCVE-2014-8375 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php.
Product
GB Gallery Slideshow
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com homelab.it
Oct 20, 2014Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to inject arbitCVE-2014-8364 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ss_id parameter.
Product
WordPress Spreadsheet (wpSS)
Affected
0.62 to 0.62
What to do
Affects 0.62 to 0.62. Update WordPress Spreadsheet (wpSS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 20, 2014SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execute arbitrary SQL comCVE-2014-8363 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.
Product
WordPress Spreadsheet (wpSS)
Affected
0.62 to 0.62
What to do
Affects 0.62 to 0.62. Update WordPress Spreadsheet (wpSS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 17, 2014Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators toCVE-2014-2995 · WordPress plugins & themes · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget
Fixed in
3.3.3
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 17, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the CVE-2014-2559 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php.
Product
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget
Fixed in
3.3.3
What to do
Update Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web scriptCVE-2014-7181 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page.
Product
Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons
Fixed in
1.26.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons to 1.26.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script CVE-2014-7138 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the Google Calendar Events
Fixed in
2.0.4
What to do
Update Cross-site scripting (XSS) vulnerability in the Google Calendar Events to 2.0.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 15, 2014Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before 3.2.1 for WordPress allows remote attackCVE-2014-6312 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the custom_style_afo parameter on the login_widget_afo page to wp-admin/options-general.php.
Product
Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget)
Fixed in
3.2.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) to 3.2.1 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Oct 14, 2014Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2014-6313 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.2.3 or newer.
Full record and what to do →NVD record seclists.org secunia.com
Oct 10, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPresCVE-2014-7139 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) form or (2) enc parameter in the CF7DBPluginShortCodeBuilder page to wp-admin/admin.php.
Fixed in
2.8.16
What to do
Update the plugin to 2.8.16 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 10, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbCVE-2014-6315 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback, (2) dir, or (3) extensions parameter in an addImages action to wp-admin/admin-ajax.php.
Product
Web-Dorado Photo Gallery
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update Web-Dorado Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Oct 10, 2014Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script orCVE-2014-6243 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngout error message.
Product
Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer
Fixed in
2.0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer to 2.0.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 6, 2014SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQCVE-2014-5389 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php.
Product
SQL injection vulnerability in content-audit-schedule.php in the Content Audit
Fixed in
1.6.1
What to do
Update SQL injection vulnerability in content-audit-schedule.php in the Content Audit to 1.6.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 2, 2014Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arCVE-2014-6242 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Product
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall
Fixed in
3.8.3
What to do
Update Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall to 3.8.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Oct 1, 2014Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers CVE-2011-4624 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
Product
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery)
Fixed in
1.57
What to do
Update Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) to 1.57 or newer.
Full record and what to do →NVD record archives.neohapsis.com plugins.trac.wordpress.org
Sep 26, 2014Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web scriCVE-2014-7152 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the update_options action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.g0blin.co.uk wordpress.org
Sep 26, 2014The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary fiCVE-2014-6446 · WordPress plugins & themes · reported by MITREHigh 7.5
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Product
Infusionsoft Gravity Forms plugin 1.5.3
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update Infusionsoft Gravity Forms plugin 1.5.3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Sep 26, 2014Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote CVE-2014-6445 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) uE or (2) uC parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.g0blin.co.uk wordpress.org
Sep 26, 2014Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP cCVE-2014-5324 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file.
Product
Unrestricted file upload vulnerability in the N-Media file uploader
Fixed in
3.4
What to do
Update Unrestricted file upload vulnerability in the N-Media file uploader to 3.4 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Sep 22, 2014SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authentiCVE-2014-7153 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php.
Product
Huge-IT Image Gallery
Affected
1.0.1 to 1.0.1
What to do
Affects 1.0.1 to 1.0.1. Update Huge-IT Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 17, 2014Mini Mail Dashboard Widget plugin 1.42 for: Cross-site scripting (XSS)CVE-2012-2583 · WordPress plugins & themes · reported by cret@cert.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.
Product
Mini Mail Dashboard Widget plugin 1.42 for
Affected
1.42 to 1.42
What to do
Affects 1.42 to 1.42. Update Mini Mail Dashboard Widget plugin 1.42 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org exploit-db.com
Sep 11, 2014Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitraCVE-2014-5460 · WordPress plugins & themes · reported by MITREMedium 6.5
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.
Product
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery
Fixed in
1.4.7
What to do
Update Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery to 1.4.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Sep 4, 2014Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2012-4768 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.
Product
Cross-site scripting (XSS) vulnerability in the Download Monitor
Fixed in
3.3.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in the Download Monitor to 3.3.5.9 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Sep 3, 2014Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitraCVE-2014-5465 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Product
Download Shortcode
Affected
up to 0.2.3
What to do
Affects up to 0.2.3. Update Download Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTMCVE-2012-4226 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Title, (2) Content, or (3) New category field to wordpress/ or (4) query string to wordpress/.
Affected
1.9.1 to 1.9.1
What to do
Affects 1.9.1 to 1.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Aug 29, 2014The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtaCVE-2014-5337 · WordPress plugins & themes · reported by MITREMedium 5
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.
Product
WordPress Mobile Pack
Fixed in
2.0.2
What to do
Update WordPress Mobile Pack to 2.0.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 26, 2014Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows remote attackers to hCVE-2014-3907 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows remote attackers to hijack the authentication of arbitrary users.
Product
Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters)
Fixed in
2.6.11
What to do
Update Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) to 2.6.11 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Aug 22, 2014Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.CVE-2014-5368 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.
Product
WP Content Source Control (wp-source-control)
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update WP Content Source Control (wp-source-control) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
Aug 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the auCVE-2014-5347 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.
Product
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System
Fixed in
2.76
What to do
Update Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System to 2.76 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authenticCVE-2014-5346 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) activate or (2) deactivate the plugin via the active parameter to wp-admin/edit-comments.php, (3) import comments via an import_comments action, or (4) export comments via an export_comments action to wp-admin/index.php.
Product
Disqus Comment System
Affected
2.77 to 2.77
What to do
Affects 2.77 to 2.77. Update Disqus Comment System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org vexatioustendencies.com
Aug 19, 2014Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrarCVE-2014-5345 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
Product
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System
Fixed in
2.76
What to do
Update Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System to 2.76 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 19, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow remote attackers to injCVE-2014-5344 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin)
Fixed in
2.3.8
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) to 2.3.8 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 12, 2014Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitraryCVE-2014-5202 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the search-value parameter.
Product
Compfight
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update Compfight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org packetstormsecurity.com
Aug 12, 2014SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter iCVE-2014-5201 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a go_view_object action to wp-admin/admin-ajax.php.
Product
Gallery Objects
Affected
0.4 to 0.4
What to do
Affects 0.4 to 0.4. Update Gallery Objects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com homelab.it
Aug 12, 2014game_play.php in the FB Gorilla plugin for: SQL injectionCVE-2014-5200 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
game_play.php in the FB Gorilla plugin for
What to do
Update game_play.php in the FB Gorilla plugin for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Aug 12, 2014Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remote attackers to hijacCVE-2014-5199 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information.
Product
Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload)
Fixed in
2.4.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) to 2.4.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 12, 2014Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5CVE-2014-5196 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.
Fixed in
1.2.5
What to do
Update the plugin to 1.2.5 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 7, 2014Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers toCVE-2014-5190 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Product
SI CAPTCHA Anti-Spam
What to do
Update SI CAPTCHA Anti-Spam to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 7, 2014lib/optin/optin_page.php in the Lead Octopus plugin for: SQL injectionCVE-2014-5189 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
lib/optin/optin_page.php in the Lead Octopus plugin for
What to do
Update lib/optin/optin_page.php in the Lead Octopus plugin for to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Aug 6, 2014Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter tCVE-2014-5187 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.
Product
Tom M8te (tom-m8te)
Affected
1.5.3 to 1.5.3
What to do
Affects 1.5.3 to 1.5.3. Update Tom M8te (tom-m8te) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrarCVE-2014-5186 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogallery_videos page to wp-admin/admin.php.
Product
All Video Gallery (all-video-gallery)
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update All Video Gallery (all-video-gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL comCVE-2014-5185 · WordPress plugins & themes · reported by MITREMedium 6
SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands via the quote parameter in an edit action in the quartz/quote_form.php page to wp-admin/edit.php.
Product
Quartz
Affected
1.01.1 to 1.01.1
What to do
Affects 1.01.1 to 1.01.1. Update Quartz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute aCVE-2014-5184 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the story parameter in an edit action to wp-admin/admin.php.
Product
stripShow
Affected
2.5.2 to 2.5.2
What to do
Affects 2.5.2 to 2.5.2. Update stripShow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allows remote authenticatCVE-2014-5183 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php.
Product
SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus)
Fixed in
4.1
What to do
Update SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) to 4.1 or newer.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.