Updated 11 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,126 results · page 15 of 23

Oct 16, 2020Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php.CVE-2020-26672 · WordPress plugins & themes · reported by MITREMedium 5.4
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database.
Fixed in
3.0.3
What to do
Update the plugin to 3.0.3 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 30, 2020There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needCVE-2020-21524 · WordPress plugins & themes · reported by MITRECritical 9.1
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Sep 14, 2020Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php.CVE-2020-25380 · WordPress plugins & themes · reported by MITREMedium 5.4
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.
Affected
0.8 to 0.8
What to do
Affects 0.8 to 0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record zeroaptitude.com zeroaptitude.com
Aug 31, 2020The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.CVE-2020-20627 · WordPress plugins & themes · reported by MITREMedium 5.3
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
Product
includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Aug 26, 2020WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user.CVE-2020-24316 · WordPress plugins & themes · reported by MITREMedium 6.1
WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org zeroaptitude.com
Aug 21, 2020ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below pluCVE-2020-20633 · WordPress plugins & themes · reported by MITREMedium 5.4
ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation.
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.CVE-2019-19111 · WordPress plugins & themes · reported by MITREMedium 6.1
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.CVE-2019-19110 · WordPress plugins & themes · reported by MITREMedium 4.8
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.CVE-2019-19109 · WordPress plugins & themes · reported by MITREHigh 8.8
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
May 26, 2020The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=foCVE-2020-13487 · WordPress plugins & themes · reported by MITREMedium 4.8
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
Product
bbPress
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bbpress.org codex.bbpress.org
May 5, 2020A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress.CVE-2020-8799 · WordPress plugins & themes · reported by MITREMedium 4.8
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website.
Product
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update A Stored XSS vulnerability has been found in the administration page of the WTI Like Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Apr 22, 2020The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.CVE-2020-12074 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.
Product
users-customers-import-export-for-wp-woocommerce
Fixed in
1.3.9
What to do
Update users-customers-import-export-for-wp-woocommerce to 1.3.9 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 22, 2020The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.CVE-2020-12073 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.
Product
responsive-add-ons
Fixed in
2.2.7
What to do
Update responsive-add-ons to 2.2.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 17, 2020The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.CVE-2018-18576 · WordPress plugins & themes · reported by MITREMedium 5.3
The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.
Product
Hustle (aka wordpress-popup)
Affected
up to 6.0.5
What to do
Affects up to 6.0.5. Update Hustle (aka wordpress-popup) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pastebin.com wordpress.org
Mar 16, 2020be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role viCVE-2020-7916 · WordPress plugins & themes · reported by MITREMedium 6.5
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
Product
LearnPress
Affected
up to 3.2.6.5
What to do
Affects up to 3.2.6.5. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2020The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via adminCVE-2020-10195 · WordPress plugins & themes · reported by MITREMedium 6.3
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.
Product
popup-builder
Fixed in
3.64.1
What to do
Update popup-builder to 3.64.1 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Mar 6, 2020A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator tCVE-2020-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
Product
A CSRF vulnerability in the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update A CSRF vulnerability in the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 18, 2020WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass VulnerabilitiesCVE-2013-4454 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities
Affected
1.4.1 to 1.4.1
What to do
Affects 1.4.1 to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Feb 8, 2020Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SCVE-2015-2062 · WordPress plugins & themes · reported by MITREHigh 7.2
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts or edit_cat action in the sliders_huge_it_slider page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image)
Fixed in
2.7.0
What to do
Update Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) to 2.7.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Feb 5, 2020The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF.CVE-2020-8658 · WordPress plugins & themes · reported by MITREHigh 8.8
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.
Product
BestWebSoft Htaccess
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update BestWebSoft Htaccess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 27, 2020WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerabilityCVE-2013-4462 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 21, 2020The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.CVE-2020-6849 · WordPress plugins & themes · reported by MITREHigh 8.8
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.
Product
marketo-forms-and-tracking
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update marketo-forms-and-tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 17, 2020The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.CVE-2020-7104 · WordPress plugins & themes · reported by MITREMedium 6.1
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.
Affected
1.1.8.1 to 1.1.8.1
What to do
Affects 1.1.8.1 to 1.1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Nov 8, 2019A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers.CVE-2019-17661 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC.
Product
codepress-admin-columns (aka Admin Columns)
Affected
3.4.6 to 3.4.6
What to do
Affects 3.4.6 to 3.4.6. Update codepress-admin-columns (aka Admin Columns) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record www2.deloitte.com www2.deloitte.com
Nov 2, 2019An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator.CVE-2019-18668 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price.
Fixed in
2.11.2
What to do
Update the plugin to 2.11.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 22, 2019The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.CVE-2015-9497 · WordPress plugins & themes · reported by MITREHigh 8.8
The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.
Product
ad-inserter
Fixed in
1.5.3
What to do
Update ad-inserter to 1.5.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Oct 18, 2019A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress.CVE-2019-17207 · WordPress plugins & themes · reported by MITREMedium 5.4
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.
Product
broken-link-checker (aka Broken Link Checker)
Affected
up to 1.11.8
What to do
Affects up to 1.11.8. Update broken-link-checker (aka Broken Link Checker) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 17, 2019WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.CVE-2019-17675 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org core.trac.wordpress.org
Oct 10, 2019The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.CVE-2015-9471 · WordPress plugins & themes · reported by MITRECritical 9.8
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.
Product
dzs-zoomsounds
Affected
up to 2.0
What to do
Affects up to 2.0. Update dzs-zoomsounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Oct 10, 2019The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.CVE-2015-9459 · WordPress plugins & themes · reported by MITREMedium 6.1
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
Product
searchterms-tagging-2
Affected
up to 1.535
What to do
Affects up to 1.535. Update searchterms-tagging-2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbCVE-2015-9456 · WordPress plugins & themes · reported by MITREMedium 6.5
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.
Product
orbisius-child-theme-creator
Fixed in
1.2.8
What to do
Update orbisius-child-theme-creator to 1.2.8 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parametCVE-2015-9455 · WordPress plugins & themes · reported by MITREHigh 8.1
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
Product
buddypress-activity-plus
Fixed in
1.6.2
What to do
Update buddypress-activity-plus to 1.6.2 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Oct 7, 2019The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.CVE-2015-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
Product
smooth-slider
Fixed in
2.7
What to do
Update smooth-slider to 2.7 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.CVE-2015-9452 · WordPress plugins & themes · reported by MITRECritical 9.8
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
Product
nex-forms-express-wp-form-builder
Fixed in
4.6.1
What to do
Update nex-forms-express-wp-form-builder to 4.6.1 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameCVE-2015-9451 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.CVE-2015-9450 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.CVE-2018-18379 · WordPress plugins & themes · reported by MITREMedium 6.1
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.
Product
elementor-edit-template class in wp-admin/customize.php in the Elementor Pro
Fixed in
2.0.10
What to do
Update elementor-edit-template class in wp-admin/customize.php in the Elementor Pro to 2.0.10 or newer.
Full record and what to do →NVD record elementor.com contextis.com
Oct 3, 2019A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or otheCVE-2019-16931 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
Product
Visualizer
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Visualizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record nathandavison.com wordpress.org
Sep 26, 2019The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.CVE-2015-9448 · WordPress plugins & themes · reported by MITREHigh 8.8
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.
Product
sendpress
Fixed in
1.2
What to do
Update sendpress to 1.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.CVE-2015-9447 · WordPress plugins & themes · reported by MITREMedium 6.5
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.CVE-2015-9446 · WordPress plugins & themes · reported by MITREHigh 8.8
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.CVE-2015-9445 · WordPress plugins & themes · reported by MITREHigh 8.8
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.CVE-2015-9443 · WordPress plugins & themes · reported by MITREMedium 6.5
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.CVE-2015-9442 · WordPress plugins & themes · reported by MITREMedium 6.5
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.CVE-2015-9441 · WordPress plugins & themes · reported by MITREMedium 6.5
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
Affected
2.9.2 to 2.9.2
What to do
Affects 2.9.2 to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.CVE-2015-9440 · WordPress plugins & themes · reported by MITREMedium 6.5
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
Product
monetize
Affected
up to 1.03
What to do
Affects up to 1.03. Update monetize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.CVE-2015-9439 · WordPress plugins & themes · reported by MITREMedium 4.8
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
Product
addthis
Fixed in
5.0.13
What to do
Update addthis to 5.0.13 or newer.
Full record and what to do →NVD record blog.cinu.pl wordpress.org
Sep 25, 2019The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameterCVE-2015-9438 · WordPress plugins & themes · reported by MITREMedium 5.4
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Product
display-widgets
Fixed in
2.04
What to do
Update display-widgets to 2.04 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.CVE-2015-9437 · WordPress plugins & themes · reported by MITREMedium 6.5
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Product
dynamic-widgets
Fixed in
1.5.11
What to do
Update dynamic-widgets to 1.5.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.CVE-2015-9436 · WordPress plugins & themes · reported by MITREMedium 5.4
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.
Product
dynamic-widgets
Fixed in
1.5.11
What to do
Update dynamic-widgets to 1.5.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.