Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
562 results · page 12 of 12
Aug 23, 2017DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.CVE-2017-13138 · WordPress plugins & themes · reported by MITREMedium 6.1
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.
- Product
- DOM based Cross-site scripting (XSS) vulnerability in the Bridge
- Fixed in
- 11.2
- What to do
- Update DOM based Cross-site scripting (XSS) vulnerability in the Bridge to 11.2 or newer.
Full record and what to do →NVD recordbridge.qodeinteractive.comimgur.com
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access conCVE-2014-8605 · WordPress plugins & themes · reported by MITREMedium 5
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/.
- Affected
- 3.1.1 to 3.1.1
- What to do
- Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapid.dhs.orgvapid.dhs.org
Mar 9, 2015Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress alCVE-2015-1874 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php.
- Fixed in
- 2.8.32
- What to do
- Update the plugin to 2.8.32 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 20, 2015Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote atCVE-2015-2040 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php.
- Product
- Contact Form DB (aka CFDB and contact-form-7-to-database-extension)
- Affected
- 2.8.26 to 2.8.26
- What to do
- Affects 2.8.26 to 2.8.26. Update Contact Form DB (aka CFDB and contact-form-7-to-database-extension) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Oct 31, 2014The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacteCVE-2014-8334 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.
- Product
- WP-DBManager (aka Database Manager)
- Fixed in
- 2.7.2
- What to do
- Update WP-DBManager (aka Database Manager) to 2.7.2 or newer.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Oct 10, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPresCVE-2014-7139 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) form or (2) enc parameter in the CF7DBPluginShortCodeBuilder page to wp-admin/admin.php.
- Fixed in
- 2.8.16
- What to do
- Update the plugin to 2.8.16 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jun 4, 2014SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitraryCVE-2014-3961 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.
- Product
- SQL injection vulnerability in the Export CSV page in the Participants Database
- Fixed in
- 1.5.4.9
- What to do
- Update SQL injection vulnerability in the Export CSV page in the Participants Database to 1.5.4.9 or newer.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
May 23, 2014The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dCVE-2014-3848 · WordPress plugins & themes · reported by MITREMedium 5
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dbinfo parameter.
- Product
- iMember360
- Fixed in
- 3.9.001
- What to do
- Update iMember360 to 3.9.001 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comreleases.imember360.com
Oct 25, 2013Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows remote attackers to CVE-2013-6281 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "page" parameter.
- Product
- Spreadsheet (dhtmlxSpreadsheet)
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update Spreadsheet (dhtmlxSpreadsheet) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate,CVE-2011-4899 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com
Aug 13, 2009wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, viCVE-2009-2762 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordarchives.neohapsis.comcore.trac.wordpress.org
Nov 19, 2007Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MDCVE-2007-6013 · WordPress plugins & themes · reported by MITRECritical 9.8
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.grok.org.ukosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.