Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

654 results · page 13 of 14

May 27, 2015Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitCVE-2015-4066 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress
Fixed in
2.3.9
What to do
Update Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress to 2.3.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 27, 2015SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to executeCVE-2015-4064 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.
Product
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages
Fixed in
1.8.5
What to do
Update SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages to 1.8.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 27, 2015Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to iCVE-2015-4063 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress
Fixed in
0.9.9
What to do
Update Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress to 0.9.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
May 27, 2015SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrCVE-2015-4062 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.
Product
SQL injection vulnerability in includes/nsp_search.php in the NewStatPress
Fixed in
0.9.9
What to do
Update SQL injection vulnerability in includes/nsp_search.php in the NewStatPress to 0.9.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Apr 14, 2015Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitraCVE-2014-9311 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the location[id] parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.
Product
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic
Fixed in
7.6.1.0
What to do
Update Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic to 7.6.1.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com security.szurek.pl
Mar 5, 2015Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.CVE-2014-9688 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
Product
Unspecified vulnerability in the Ninja Forms
Fixed in
2.8.10
What to do
Update Unspecified vulnerability in the Ninja Forms to 2.8.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 3, 2015Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrarCVE-2015-2199 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player
Fixed in
2.1
What to do
Update Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player to 2.1 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Mar 3, 2015Unrestricted file upload vulnerability in the fusion_options function in functions.php in the Fusion theme 3.1 for Wordpress allows remote authenticated users tCVE-2015-2194 · WordPress plugins & themes · reported by MITREMedium 6.5
Unrestricted file upload vulnerability in the fusion_options function in functions.php in the Fusion theme 3.1 for Wordpress allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension in a fusion_save action, then accessing it via unspecified vectors.
Product
Fusion
Affected
3.1 to 3.1
What to do
Affects 3.1 to 3.1. Update Fusion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Feb 2, 2015SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the CVE-2015-1393 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.
Product
SQL injection vulnerability in the Photo Gallery
Fixed in
1.2.11
What to do
Update SQL injection vulnerability in the Photo Gallery to 1.2.11 or newer.
Full record and what to do →NVD record securityfocus.com plugins.trac.wordpress.org
Jan 28, 2015pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrCVE-2015-1376 · WordPress plugins & themes · reported by MITREMedium 4
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
Product
pixabay-images.php in the Pixabay Images
Fixed in
2.4
What to do
Update pixabay-images.php in the Pixabay Images to 2.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 13, 2015Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject arbitrary web script oCVE-2014-100007 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the HK Exif Tags
Fixed in
1.12
What to do
Update Cross-site scripting (XSS) vulnerability in the HK Exif Tags to 1.12 or newer.
Full record and what to do →NVD record secunia.com exchange.xforce.ibmcloud.com
Jan 2, 2015Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to read arbitrary CVE-2014-9461 · WordPress plugins & themes · reported by MITRELow 3.5
Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the member_download action to wp-admin/admin-ajax.php.
Product
Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite
Fixed in
1.5.4
What to do
Update Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite to 1.5.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org research.g0blin.co.uk
Jan 2, 2015SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitraryCVE-2014-9442 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php.
Product
SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite
Fixed in
1.5.4
What to do
Update SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite to 1.5.4 or newer.
Full record and what to do →NVD record secunia.com plugins.trac.wordpress.org
Dec 24, 2014SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrCVE-2014-8810 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action.
Product
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium
Fixed in
14.11
What to do
Update SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium to 14.11 or newer.
Full record and what to do →NVD record secunia.com security.szurek.pl
Dec 2, 2014Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web sCVE-2014-9179 · WordPress plugins & themes · reported by MITREMedium 4
Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the "URL (optional)" field in a new ticket.
Product
SupportEzzy Ticket System
Affected
1.2.5 to 1.2.5
What to do
Affects 1.2.5 to 1.2.5. Update SupportEzzy Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 2, 2014Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites andCVE-2014-8754 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the out parameter.
Product
Ad-Manager
Affected
1.1.2 to 1.1.2
What to do
Affects 1.1.2 to 1.1.2. Update Ad-Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 5, 2014Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitraryCVE-2014-8622 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the search-value parameter.
Product
Compfight
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update Compfight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org packetstormsecurity.com
Oct 31, 2014The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacteCVE-2014-8334 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.
Product
WP-DBManager (aka Database Manager)
Fixed in
2.7.2
What to do
Update WP-DBManager (aka Database Manager) to 2.7.2 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Oct 2, 2014Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arCVE-2014-6242 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Product
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall
Fixed in
3.8.3
What to do
Update Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall to 3.8.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Sep 26, 2014Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP cCVE-2014-5324 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file.
Product
Unrestricted file upload vulnerability in the N-Media file uploader
Fixed in
3.4
What to do
Update Unrestricted file upload vulnerability in the N-Media file uploader to 3.4 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Sep 11, 2014Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitraCVE-2014-5460 · WordPress plugins & themes · reported by MITREMedium 6.5
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.
Product
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery
Fixed in
1.4.7
What to do
Update Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery to 1.4.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Aug 19, 2014Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbitrary web script or CVE-2014-3903 · WordPress plugins & themes · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via crafted Exif data.
Product
Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x
Fixed in
1.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x to 1.6.2 or newer.
Full record and what to do →NVD record jayj.dk jvn.jp
Aug 12, 2014Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitraryCVE-2014-5202 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the search-value parameter.
Product
Compfight
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update Compfight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org packetstormsecurity.com
Aug 6, 2014SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL comCVE-2014-5185 · WordPress plugins & themes · reported by MITREMedium 6
SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands via the quote parameter in an edit action in the quartz/quote_form.php page to wp-admin/edit.php.
Product
Quartz
Affected
1.01.1 to 1.01.1
What to do
Affects 1.01.1 to 1.01.1. Update Quartz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SCVE-2014-5182 · WordPress plugins & themes · reported by MITREMedium 6
Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via vectors related to (1) admin_functions.php or (2) admin_update.php, as demonstrated by the id parameter in the update action to wp-admin/admin.php.
Product
yawpp
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update yawpp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wordpress.org
Jul 14, 2014Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to executCVE-2014-4944 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php.
Product
BSK PDF Manager
Affected
1.3.2 to 1.3.2
What to do
Affects 1.3.2 to 1.3.2. Update BSK PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress allows remote attacCVE-2014-4532 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Product
Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale
Fixed in
1.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale to 1.2.3 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org
Jun 2, 2014Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the authentication of users CVE-2013-3258 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in he Digg Digg
Fixed in
5.3.5
What to do
Update Cross-site request forgery (CSRF) vulnerability in he Digg Digg to 5.3.5 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 27, 2014Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users CVE-2013-2698 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Calendar
Fixed in
1.3.3
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Calendar to 1.3.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 23, 2014The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a reqCVE-2014-3849 · WordPress plugins & themes · reported by MITREMedium 4.3
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter.
Product
iMember360 plugin 3.8.012
Affected
up to 3.9.001
What to do
Affects up to 3.9.001. Update iMember360 plugin 3.8.012 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Apr 9, 2014WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includeCVE-2014-0165 · WordPress plugins & themes · reported by Red HatMedium 4
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Fixed in
3.7.2
What to do
Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD record codex.wordpress.org codex.wordpress.org
Mar 28, 2014Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and coCVE-2013-2694 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 5.8
Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the u parameter.
Product
WP Symposium
Affected
13.04 to 13.04
What to do
Affects 13.04 to 13.04. Update WP Symposium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com
Feb 28, 2014Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script orCVE-2014-1888 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
Product
Cross-site scripting (XSS) vulnerability in the BuddyPress
Fixed in
1.9.2
What to do
Update Cross-site scripting (XSS) vulnerability in the BuddyPress to 1.9.2 or newer.
Full record and what to do →NVD record buddypress.org osvdb.org
Jan 20, 2014wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform CVE-2011-5270 · WordPress plugins & themes · reported by MITREMedium 4
wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role.
Fixed in
3.0.6
What to do
Update the plugin to 3.0.6 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might alloCVE-2010-5297 · WordPress plugins & themes · reported by MITRELow 2.1
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Fixed in
3.0.1
What to do
Update the plugin to 3.0.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capabCVE-2010-5296 · WordPress plugins & themes · reported by MITREMedium 4.9
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
Fixed in
3.0.2
What to do
Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Sep 12, 2013The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users tCVE-2013-5739 · WordPress plugins & themes · reported by MITRELow 3.5
The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.
Fixed in
3.6.1
What to do
Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Sep 12, 2013wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and proviCVE-2013-4340 · WordPress plugins & themes · reported by Red HatLow 3.5
wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.
Fixed in
3.6.1
What to do
Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jul 8, 2013WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing CVE-2013-2200 · WordPress plugins & themes · reported by Red HatMedium 4
WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors.
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record codex.wordpress.org wordpress.org
Jan 23, 2013Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbCVE-2012-6511 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) delete_id parameter or (2) extension parameter in an "Update Setting" action to wp-admin/admin.php.
Product
Organizer
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org websecurity.com.ua
Jan 11, 2013Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arCVE-2012-6499 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.
Product
Age Verification
Affected
up to 0.4
What to do
Affects up to 0.4. Update Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com osvdb.org
Oct 9, 2012SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrarCVE-2012-5350 · WordPress plugins & themes · reported by MITREMedium 6
SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the id parameter in a paywithtweet shortcode.
Product
SQL injection vulnerability in the Pay With Tweet
Fixed in
1.2
What to do
Update SQL injection vulnerability in the Pay With Tweet to 1.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Oct 8, 2012Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated usersCVE-2012-5328 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated users to execute arbitrary SQL commands via the (1) memberid or (2) groupid parameters in a removemember action or (3) id parameter to fs-admin/fs-admin.php, or (4) edit_forum_id parameter in an edit_save_forum action to fs-admin/wpf-edit-forum-group.php.
Product
Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions
Fixed in
1.0.33
What to do
Update Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions to 1.0.33 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 14, 2012The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users toCVE-2010-5106 · WordPress plugins & themes · reported by Red HatMedium 6.5
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.
Fixed in
3.0.3
What to do
Update the plugin to 3.0.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Dec 2, 2011wp-users.php in WordPress Users plugin 1.3 and possibly earlier for: SQL injectionCVE-2011-4669 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.
Product
wp-users.php in WordPress Users plugin 1.3 and possibly earlier for
What to do
Update wp-users.php in WordPress Users plugin 1.3 and possibly earlier for to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Mar 14, 2011wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a mCVE-2011-0701 · WordPress plugins & themes · reported by Red HatMedium 4
wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.
Fixed in
3.0.5
What to do
Update the plugin to 3.0.5 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Mar 14, 2011Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectorCVE-2011-0700 · WordPress plugins & themes · reported by Red HatLow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box.
Fixed in
3.0.5
What to do
Update the plugin to 3.0.5 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Feb 23, 2010WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.CVE-2010-0682 · WordPress plugins & themes · reported by MITREMedium 4
WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.
Fixed in
2.9.2
What to do
Update the plugin to 2.9.2 or newer.
Full record and what to do →NVD record hakre.wordpress.com lists.fedoraproject.org
Feb 7, 2008The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via uCVE-2008-0664 · WordPress plugins & themes · reported by MITREMedium 6.4
The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via unknown vectors.
Fixed in
2.3.3
What to do
Update the plugin to 2.3.3 or newer.
Full record and what to do →NVD record secunia.com secunia.com
Apr 9, 2007xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictionsCVE-2007-1893 · WordPress plugins & themes · reported by MITREMedium 4.9
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.