Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

485new WordPress flaws this week

392,772entries in the database

5,780 results · page 115 of 116

Dec 9, 2010Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject aCVE-2010-4518 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter.
Product
Safe Search
What to do
Update Safe Search to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 6, 2010The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php andCVE-2010-4403 · WordPress plugins & themes · reported by MITREMedium 5
The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message.
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org websecurity.com.ua
Dec 6, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to injectCVE-2010-4402 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.
Product
Register Plus
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Register Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Nov 3, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject aCVE-2010-3977 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com conviso.com.br
Jul 30, 2010SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url CVE-2010-2924 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information.
Product
myLinksDump
What to do
Update myLinksDump to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 7, 2010Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitraCVE-2010-1186 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
Product
Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery
Fixed in
1.5.2
What to do
Update Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery to 1.5.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 26, 2010SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQCVE-2009-4748 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
Product
My Category Order
Affected
up to 2.8
What to do
Affects up to 2.8. Update My Category Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org exploit-db.com
Mar 5, 2010Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files viCVE-2009-4672 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.
Product
WP-Lytebox
What to do
Update WP-Lytebox to the newest version.
Full record and what to do →NVD record secunia.com exploit-db.com
Feb 22, 2010SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitCVE-2010-0673 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.
Product
Copperleaf Photolog
What to do
Update Copperleaf Photolog to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Dec 28, 2009SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2009-4424 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Pyrmont
What to do
Update Pyrmont to the newest version.
Full record and what to do →NVD record packetstormsecurity.org exploit-db.com
Dec 18, 2009Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the searCVE-2009-3703 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.
Product
Multiple SQL injection vulnerabilities in the WP-Forum
Fixed in
2.4
What to do
Update Multiple SQL injection vulnerabilities in the WP-Forum to 2.4 or newer.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 2, 2009Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and eCVE-2009-4168 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.
Product
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus
Affected
up to 2.0
Fixed in
1.23
What to do
Update Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus to 1.23 or newer.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Sep 11, 2009Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which aCVE-2008-7216 · WordPress plugins & themes · reported by MITREMedium 4.3
Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record docs.google.com securityfocus.com
Sep 8, 2009wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for: Cross-site scripting (XSS)CVE-2008-7175 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.
Product
wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for
Affected
up to 0.96
What to do
Affects up to 0.96. Update wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org securityfocus.com
Aug 18, 2009WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_heCVE-2009-2852 · WordPress plugins & themes · reported by MITREMedium 6.8
WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.
Affected
up to 0.9.1
What to do
Affects up to 0.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Aug 13, 2009wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, viCVE-2009-2762 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com core.trac.wordpress.org
Jul 10, 2009WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote CVE-2009-2335 · WordPress plugins & themes · reported by MITREMedium 5
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Fixed in
2.8.1
What to do
Update the plugin to 2.8.1 or newer.
Full record and what to do →NVD record corelabs.coresecurity.com securitytracker.com
Jul 10, 2009wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which alloCVE-2009-2334 · WordPress plugins & themes · reported by MITREMedium 4.9
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
Fixed in
2.8.1
What to do
Update the plugin to 2.8.1 or newer.
Full record and what to do →NVD record corelabs.coresecurity.com securitytracker.com
Jul 9, 2009template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin,: PHP remote file inclusionCVE-2009-2396 · WordPress plugins & themes · reported by MITREHigh 9.3
PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.
Product
template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin,
What to do
Update template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, to the newest version.
Full record and what to do →NVD record secunia.com exploit-db.com
Jul 8, 2009SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via thCVE-2009-2383 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.
Product
Related Sites
What to do
Update Related Sites to the newest version.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Jun 22, 2009SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified CVE-2009-2144 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
SQL injection vulnerability in the FireStats
Fixed in
1.6.2-stable
What to do
Update SQL injection vulnerability in the FireStats to 1.6.2-stable or newer.
Full record and what to do →NVD record firestats.cc secunia.com
Jun 22, 2009PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute CVE-2009-2143 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter.
Product
PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats
Fixed in
1.6.2-stable
What to do
Update PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats to 1.6.2-stable or newer.
Full record and what to do →NVD record firestats.cc secunia.com
Jun 19, 2009SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands CVE-2009-2122 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Paolo Palmonari Photoracer
What to do
Update Paolo Palmonari Photoracer to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
May 18, 2009Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitraCVE-2008-6811 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/.
Product
e-Commerce
Affected
up to 3.4
What to do
Affects up to 3.4. Update e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Mar 19, 2009SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameteCVE-2009-0968 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: some of these details are obtained from third party information.
Product
fMoblog
What to do
Update fMoblog to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 30, 2008Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allCVE-2008-5752 · WordPress plugins & themes · reported by MITREMedium 4.3
Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details are obtained from third party information.
Product
Page Flip Image Gallery
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update Page Flip Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 24, 2008Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackeCVE-2008-4734 · WordPress plugins & themes · reported by MITREHigh 7.5
Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to perform unauthorized actions as administrators via a request that sets the wpcr_hidden_form_input parameter.
Product
Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix
Fixed in
1.4.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix to 1.4.4 or newer.
Full record and what to do →NVD record chxsecurity.org secunia.com
Oct 24, 2008Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitraryCVE-2008-4733 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) replytotext, (2) quotetext, (3) originallypostedby, (4) sep, (5) maxtags, (6) tagsep, (7) tagheadersep, (8) taglabel, and (9) tagheaderlabel parameters.
Product
Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix
Fixed in
1.4.4
What to do
Update Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix to 1.4.4 or newer.
Full record and what to do →NVD record chxsecurity.org secunia.com
Oct 24, 2008SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to execute arbitrary SQL commCVE-2008-4732 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the p parameter.
Product
SQL injection vulnerability in ajax_comments.php in the WP Comment Remix
Fixed in
1.4.4
What to do
Update SQL injection vulnerability in ajax_comments.php in the WP Comment Remix to 1.4.4 or newer.
Full record and what to do →NVD record chxsecurity.org secunia.com
Oct 20, 2008The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.CVE-2008-4616 · WordPress plugins & themes · reported by MITREMedium 5
The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityreason.com securityfocus.com
Sep 18, 2008WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login columnCVE-2008-4106 · WordPress plugins & themes · reported by MITREMedium 5.1
WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by also exploiting CVE-2008-4107.
Fixed in
2.6.2
What to do
Update the plugin to 2.6.2 or newer.
Full record and what to do →NVD record marc.info secunia.com
May 29, 2008wp-uploadfile.php in the Upload File plugin for: SQL injectionCVE-2008-2510 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-uploadfile.php in the Upload File plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the f_id parameter.
Product
wp-uploadfile.php in the Upload File plugin for
What to do
Update wp-uploadfile.php in the Upload File plugin for to the newest version.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Apr 30, 2008wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for: SQL injectionCVE-2008-2034 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for
What to do
Update wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Apr 2, 2008wp-download.php in the WP-Download 1.2 plugin for: SQL injectionCVE-2008-1646 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the dl_id parameter.
Product
wp-download.php in the WP-Download 1.2 plugin for
What to do
Update wp-download.php in the WP-Download 1.2 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Feb 28, 2008Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script oCVE-2008-1061 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 28, 2008modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for: PHP remote file inclusionCVE-2008-1059 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.
Product
modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for
What to do
Update modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 28, 2008modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for: Eval injectionCVE-2008-1060 · WordPress plugins & themes · reported by MITREHigh 7.5
Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text parameter.
Product
modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for
What to do
Update modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 25, 2008Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL CVE-2008-0939 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the photo parameter to index.php, used by the wppa_photo_name function; or (2) the album parameter to index.php, used by the wppa_album_name function. NOTE: some of these details are obtained from third party information.
Fixed in
1.1
What to do
Update the plugin to 1.1 or newer.
Full record and what to do →NVD record me.mywebsight.ws secunia.com
Feb 20, 2008wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for: SQL injectionCVE-2008-0845 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the person parameter.
Product
wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for
What to do
Update wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for to the newest version.
Full record and what to do →NVD record securityreason.com securityfocus.com
Feb 20, 2008the log feature in the John Godley Search Unleashed 0.2.10 plugin for: Cross-site scripting (XSS)CVE-2008-0837 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the log feature in the John Godley Search Unleashed 0.2.10 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, which is not properly handled when the administrator views the log file.
Product
the log feature in the John Godley Search Unleashed 0.2.10 plugin for
What to do
Update the log feature in the John Godley Search Unleashed 0.2.10 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 11, 2008Multiple cross-site scripting (XSS) vulnerabilities in admin_panel.php in the Simon Elvery WP-Footnotes 2.2 plugin for WordPress allow remote attackers to injecCVE-2008-0691 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in admin_panel.php in the Simon Elvery WP-Footnotes 2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wp_footnotes_current_settings[priority], (2) wp_footnotes_current_settings[style_rules], (3) wp_footnotes_current_settings[pre_footnotes], and (4) wp_footnotes_current_settings[post_footnotes] parameters.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 11, 2008SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via tCVE-2008-0682 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
SQL injection vulnerability in wordspew-rss.php in the Wordspew
Fixed in
3.72
What to do
Update SQL injection vulnerability in wordspew-rss.php in the Wordspew to 3.72 or newer.
Full record and what to do →NVD record pierre.sudarovich.free.fr secunia.com
Feb 6, 2008the administration panel in the DMSGuestbook 1.7.0 plugin for: SQL injectionCVE-2008-0616 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors. NOTE: it is not clear whether this issue crosses privilege boundaries.
Product
the administration panel in the DMSGuestbook 1.7.0 plugin for
Affected
1.7.0 to 1.7.0
What to do
Affects 1.7.0 to 1.7.0. Update the administration panel in the DMSGuestbook 1.7.0 plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityreason.com securityfocus.com
Feb 6, 2008Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web scriCVE-2008-0618 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) gbname, (2) gbemail, (3) gburl, and (4) gbmsg parameters to unspecified programs. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com secunia.com
Feb 6, 2008Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTMLCVE-2008-0617 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter to wp-admin/admin.php, or the (2) messagefield parameter in the guestbook page, and the (3) title parameter in the messagearea.
Affected
1.7.0 to 1.7.0
What to do
Affects 1.7.0 to 1.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityreason.com securityfocus.com
Feb 6, 2008wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for: Directory traversalCVE-2008-0615 · WordPress plugins & themes · reported by MITREMedium 4
Directory traversal vulnerability in wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) folder and (2) file parameters.
Product
wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for
What to do
Update wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Jan 31, 2008adclick.php in the AdServe 0.2 plugin for: SQL injectionCVE-2008-0507 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
adclick.php in the AdServe 0.2 plugin for
What to do
Update adclick.php in the AdServe 0.2 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Jan 31, 2008deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for: Cross-site request forgery (CSRF)CVE-2008-0508 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the oldstructure (aka dean_pm_config[oldstructure]) configuration setting as administrators via the old_struct parameter in a deans_permalinks_migration.php action to wp-admin/options-general.php, as demonstrated by placing an XSS sequence in this setting.
Product
deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for
What to do
Update deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for to the newest version.
Full record and what to do →NVD record g30rg3x.com g30rg3x.com
Jan 31, 2008Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commandsCVE-2008-0520 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.
Product
Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com securityfocus.com
Jan 30, 2008fim_rss.php in the fGallery 2.4.1 plugin for: SQL injectionCVE-2008-0491 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the album parameter.
Product
fim_rss.php in the fGallery 2.4.1 plugin for
Affected
2.4.1 to 2.4.1
What to do
Affects 2.4.1 to 2.4.1. Update fim_rss.php in the fGallery 2.4.1 plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vupen.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.