Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

522 results · page 11 of 11

Aug 22, 2019The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.CVE-2018-20986 · WordPress plugins & themes · reported by MITREMedium 5.4
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
Product
advanced-custom-fields (aka Elliot Condon Advanced Custom Fields)
Fixed in
5.7.8
What to do
Update advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) to 5.7.8 or newer.
Full record and what to do →NVD record wordpress.org advancedcustomfields.com
Aug 22, 2019The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-15318 · WordPress plugins & themes · reported by MITRECritical 9.8
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
Product
yikes-inc-easy-mailchimp-extender
Fixed in
6.5.3
What to do
Update yikes-inc-easy-mailchimp-extender to 6.5.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.CVE-2013-7479 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
Product
events-manager
Fixed in
5.3.9
What to do
Update events-manager to 5.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.CVE-2017-18563 · WordPress plugins & themes · reported by MITREMedium 6.1
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
Product
rsvp
Fixed in
2.3.8
What to do
Update rsvp to 2.3.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-15238 · WordPress plugins & themes · reported by MITREHigh 8.8
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
Product
cforms2
Fixed in
15.0.2
What to do
Update cforms2 to 15.0.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.CVE-2013-7476 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
Product
simple-fields
Fixed in
1.2
What to do
Update simple-fields to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The simple-fields plugin before 1.4.11 for WordPress has XSS.CVE-2015-9302 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-fields plugin before 1.4.11 for WordPress has XSS.
Product
simple-fields
Fixed in
1.4.11
What to do
Update simple-fields to 1.4.11 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 11, 2019The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.CVE-2019-13505 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
Affected
1.1.44 to 1.1.44
What to do
Affects 1.1.44 to 1.1.44. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
May 9, 2019The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.CVE-2019-11871 · WordPress plugins & themes · reported by MITREMedium 5.4
The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.
Product
Custom Field Suite
Fixed in
2.5.15
What to do
Update Custom Field Suite to 2.5.15 or newer.
Full record and what to do →NVD record blog.reddy.io wordpress.org
Apr 2, 2019In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.CVE-2019-10692 · WordPress plugins & themes · reported by MITRECritical 9.8
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.
Product
In the wp-google-maps
Fixed in
7.11.18
What to do
Update In the wp-google-maps to 7.11.18 or newer.
Full record and what to do →NVD record packetstormsecurity.com rapid7.com
Apr 1, 2019pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionCoCVE-2019-6715 · WordPress plugins & themes · reported by MITREHigh 7.5
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.
Product
pub/sns.php in the W3 Total Cache
Fixed in
0.9.4
What to do
Update pub/sns.php in the W3 Total Cache to 0.9.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com vinhjaxt.github.io
Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.CVE-2019-9567 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.
Product
Forminator Contact Form, Poll & Quiz Builder
Fixed in
1.6
What to do
Update Forminator Contact Form, Poll & Quiz Builder to 1.6 or newer.
Full record and what to do →NVD record lists.openwall.net security-consulting.icu
Dec 22, 2018The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.CVE-2018-20368 · WordPress plugins & themes · reported by MITREMedium 5.4
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Product
wp-slimstat (aka Slimstat Analytics)
Fixed in
4.1.6.1
What to do
Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Sep 17, 2018The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.CVE-2018-17138 · WordPress plugins & themes · reported by MITREMedium 5.4
The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.
Product
Jibu Pro
Affected
up to 1.7
What to do
Affects up to 1.7. Update Jibu Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
May 4, 2018The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.CVE-2018-10752 · WordPress plugins & themes · reported by MITREMedium 4.8
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
Affected
0.6 to 0.6
What to do
Affects 0.6 to 0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pastebin.com exploit-db.com
Apr 23, 2018The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.CVE-2018-10309 · WordPress plugins & themes · reported by MITREMedium 5.4
The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.
Product
Responsive Cookie Consent
Fixed in
1.8
What to do
Update Responsive Cookie Consent to 1.8 or newer.
Full record and what to do →NVD record gist.github.com wordpress.org
Apr 23, 2018Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input fieldCVE-2018-10234 · WordPress plugins & themes · reported by MITREMedium 4.8
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account page.
Product
Authenticated Cross site Scripting exists in the User Profile & Membership
Fixed in
2.0.11
What to do
Update Authenticated Cross site Scripting exists in the User Profile & Membership to 2.0.11 or newer.
Full record and what to do →NVD record github.com wordpress.org
Apr 9, 2018The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.CVE-2018-9864 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.
Product
WP Live Chat Support
Fixed in
8.0.06
What to do
Update WP Live Chat Support to 8.0.06 or newer.
Full record and what to do →NVD record wordpress.org gubello.me
Dec 2, 2017wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks CVE-2017-17094 · WordPress plugins & themes · reported by MITREMedium 5.4
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.
Fixed in
4.9.1
What to do
Update the plugin to 4.9.1 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Sep 26, 2017The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.CVE-2017-14751 · WordPress plugins & themes · reported by MITREMedium 6.1
The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record bbs.microdesktop.com securityfocus.com
Jun 15, 2017Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScCVE-2017-9419 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter.
Product
Webhammer WP Custom Fields Search
Affected
0.3.28 to 0.3.28
What to do
Affects 0.3.28 to 0.3.28. Update Webhammer WP Custom Fields Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.