Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

525 results · page 11 of 11

Dec 13, 2021browsing database which may allow a user to browse unauthorized data: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20865 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
Product
browsing database which may allow a user to browse unauthorized data
What to do
Update browsing database which may allow a user to browse unauthorized data to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Nov 30, 2021Browser and Operating System Finder versions prior to 1.2: Cross-site request forgery (CSRF)CVE-2021-20851 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.
Product
Browser and Operating System Finder versions prior to 1.2
Fixed in
1.2
What to do
Update Browser and Operating System Finder versions prior to 1.2 to 1.2 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Aug 23, 2021Broken Link Manager: Does not sanitiseCVE-2021-24550 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue
Product
Broken Link Manager
Affected
up to 0.6.5
What to do
Affects up to 0.6.5. Update Broken Link Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 9, 2021Side Menu Lite – add sticky fixed buttons: Does not properly sanitize input values from the browserCVE-2021-24521 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
Product
Side Menu Lite – add sticky fixed buttons
Fixed in
2.2.1
What to do
Update Side Menu Lite – add sticky fixed buttons to 2.2.1 or newer.
Full record and what to do →NVD record github.com wpscan.com
Jul 12, 2021Browser Screenshots: Allowed authenticated users with a roleCVE-2021-24439 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Browser Screenshots WordPress plugin before 1.7.6 allowed authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks as the image_class parameter of the browser-shot shortcode was not escaped.
Product
Browser Screenshots
Fixed in
1.7.6
What to do
Update Browser Screenshots to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2021The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped beforeCVE-2021-24337 · WordPress plugins & themes · reported by WPScanHigh 8.8
The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
Product
Video Embed
Affected
up to 1.0
What to do
Affects up to 1.0. Update Video Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Apr 5, 2021When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wtsCVE-2021-24167 · WordPress plugins & themes · reported by WPScanHigh 7.5
When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookup_WP_account.
Fixed in
1.4.1
What to do
Update the plugin to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 7, 2020An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress.CVE-2020-9514 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subscriber role) to permanently delete arbitrary posts and pages, create new posts with arbitrary subjects, and modify the subjects of existing posts and pages (via create_dynamic_page and delete_dynamic_page).
Product
An issue was discovered in the IMPress for IDX Broker
Fixed in
2.6.2
What to do
Update An issue was discovered in the IMPress for IDX Broker to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 7, 2020Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrCVE-2020-11512 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts.
Product
IMPress for IDX Broker
Fixed in
2.6.2
What to do
Update IMPress for IDX Broker to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 18, 2019A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress.CVE-2019-17207 · WordPress plugins & themes · reported by MITREMedium 5.4
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.
Product
broken-link-checker (aka Broken Link Checker)
Affected
up to 1.11.8
What to do
Affects up to 1.11.8. Update broken-link-checker (aka Broken Link Checker) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 16, 2019The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of CVE-2019-16521 · WordPress plugins & themes · reported by MITREMedium 6.1
The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_id=search request. NOTE: this is an end-of-life product.
Product
broken-link-checker
Affected
up to 1.11.8
What to do
Affects up to 1.11.8. Update broken-link-checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2019The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.CVE-2015-9468 · WordPress plugins & themes · reported by MITREMedium 6.1
The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.
Affected
0.4.5 to 0.4.5
What to do
Affects 0.4.5 to 0.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 10, 2019The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.CVE-2015-9467 · WordPress plugins & themes · reported by MITRECritical 9.8
The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.
Product
broken-link-manager
Fixed in
0.5.0
What to do
Update broken-link-manager to 0.5.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.CVE-2015-9453 · WordPress plugins & themes · reported by MITREMedium 6.1
The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
Product
broken-link-manager
Fixed in
0.6.0
What to do
Update broken-link-manager to 0.6.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.CVE-2015-9404 · WordPress plugins & themes · reported by MITREMedium 6.1
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.CVE-2015-9403 · WordPress plugins & themes · reported by MITREMedium 6.1
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Aug 27, 2019The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.CVE-2015-9349 · WordPress plugins & themes · reported by MITREMedium 6.1
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
Product
ckeditor-for-wordpress
Fixed in
4.5.3.1
What to do
Update ckeditor-for-wordpress to 4.5.3.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.CVE-2016-10897 · WordPress plugins & themes · reported by MITREMedium 6.1
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
Product
sermon-browser
Fixed in
0.45.16
What to do
Update sermon-browser to 0.45.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.CVE-2015-9319 · WordPress plugins & themes · reported by MITREMedium 6.1
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Product
gregs-high-performance-seo
Fixed in
1.6.2
What to do
Update gregs-high-performance-seo to 1.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Sep 24, 2018The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.CVE-2018-16283 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org github.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.CVE-2018-5364 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Aug 18, 2017Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.CVE-2015-5057 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.
Fixed in
1.10.9
What to do
Update the plugin to 1.10.9 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Dec 31, 2014Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows remote attackers to hijCVE-2014-9392 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the pictoBrowserFlickrUser parameter in the options-page.php page to wp-admin/options-general.php.
Product
PictoBrowser (pictobrowser-gallery)
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update PictoBrowser (pictobrowser-gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 1, 2007the internal browser in i-Systems Feedreader 3.10: Cross-zone scriptingCVE-2007-5161 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-zone scripting vulnerability in the internal browser in i-Systems Feedreader 3.10 allows remote attackers to inject arbitrary web script or HTML via an item in a feed, as demonstrated by a WordPress blog update. NOTE: this was originally reported as XSS.
Product
the internal browser in i-Systems Feedreader 3.10
What to do
Update the internal browser in i-Systems Feedreader 3.10 to the newest version.
Full record and what to do →NVD record marc.info osvdb.org
May 1, 2007myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for: PHP remote file inclusionCVE-2007-2426 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the myPath parameter.
Product
myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for
Affected
up to 1.4b4
What to do
Affects up to 1.4b4. Update myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.