Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

761 results · page 15 of 16

Dec 13, 2021User Meta Shortcodes: Registers a shortcode that allows any user with a roleCVE-2021-24859 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
Product
User Meta Shortcodes
Affected
up to 0.5
What to do
Affects up to 0.5. Update User Meta Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021SEO Booster: Allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX requestCVE-2021-24747 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections.
Product
SEO Booster
Fixed in
3.8
What to do
Update SEO Booster to 3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021Registrations for the Events Calendar: Does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2021-24943 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
Product
Registrations for the Events Calendar
Fixed in
2.7.6
What to do
Update Registrations for the Events Calendar to 2.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021WP Performance Score Booster: Does not have CSRF checkCVE-2021-24776 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
WP Performance Score Booster
Fixed in
2.1
What to do
Update WP Performance Score Booster to 2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021OptinMonster: Sensitive information disclosure and unauthorized setting updatesCVE-2021-39341 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.
Product
OptinMonster
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2021NextScripts: Social Networks Auto-Poster <= 4.3.20: Reflected Cross-Site ScriptingCVE-2021-38356 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['page'] parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load the page in $_GET['page'] along with malicious JavaScript in $_POST['page'].
Product
NextScripts: Social Networks Auto-Poster <= 4.3.20
Affected
up to 4.3.20
What to do
Affects up to 4.3.20. Update NextScripts: Social Networks Auto-Poster <= 4.3.20 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Oct 15, 2021MyBB Cross-Poster: Stored Cross-Site ScriptingCVE-2021-39338 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
MyBB Cross-Poster
Affected
up to 1.0
What to do
Affects up to 1.0. Update MyBB Cross-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 11, 2021del_reistered_domains AJAX action of the Software License Manager: Does not have any CSRF checksCVE-2021-24711 · WordPress plugins & themes · reported by WPScanHigh 8.8
The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack
Product
del_reistered_domains AJAX action of the Software License Manager
Fixed in
4.5.1
What to do
Update del_reistered_domains AJAX action of the Software License Manager to 4.5.1 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Oct 11, 2021Quiz And Survey Master: Does not escape the Quiz Url Slug setting before outputting it in some pagesCVE-2021-24691 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Quiz And Survey Master
Fixed in
7.3.2
What to do
Update Quiz And Survey Master to 7.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021OptinMonster: Reflected Cross-Site ScriptingCVE-2021-39325 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.6.0.
Product
OptinMonster
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 2, 2021The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `incluCVE-2021-38314 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Product
Gutenberg Template Library & Redux Framework
Affected
up to 4.2.11
What to do
Affects up to 4.2.11. Update Gutenberg Template Library & Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Sep 2, 2021The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered underCVE-2021-38312 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.
Product
Gutenberg Template Library & Redux Framework
Affected
up to 4.2.11
What to do
Affects up to 4.2.11. Update Gutenberg Template Library & Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 30, 2021Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verificationCVE-2021-34646 · WordPress plugins & themes · reported by WordfenceCritical 9.8
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.
Product
Booster for WooCommerce
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 18, 2021Quiz And Survey Master versions prior to 7.1.14: Cross-site scriptingCVE-2021-20792 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.
Product
Quiz And Survey Master versions prior to 7.1.14
Fixed in
7.1.14
What to do
Update Quiz And Survey Master versions prior to 7.1.14 to 7.1.14 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Aug 2, 2021Speed Booster Pack ⚡ PageSpeed Optimization Suite: Did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP fileCVE-2021-24430 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE
Product
Speed Booster Pack ⚡ PageSpeed Optimization Suite
Fixed in
4.2.0
What to do
Update Speed Booster Pack ⚡ PageSpeed Optimization Suite to 4.2.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jul 6, 2021The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised usCVE-2021-24384 · WordPress plugins & themes · reported by WPScanCritical 9.8
The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE
Product
JoomSport
Fixed in
5.1.8
What to do
Update JoomSport to 5.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2021Quiz And Survey Master – Best Quiz, Exam and Survey: Did not sanitise or escape its result_id parameterCVE-2021-24368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link
Product
Quiz And Survey Master – Best Quiz, Exam and Survey
Fixed in
7.1.18
What to do
Update Quiz And Survey Master – Best Quiz, Exam and Survey to 7.1.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Contact Form Check Tester: Settings are visible to all registered users in the dashboard and are lacking any sanitisationCVE-2021-24247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
Product
Contact Form Check Tester
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Contact Form Check Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low prCVE-2021-24244 · WordPress plugins & themes · reported by WPScanMedium 6.5
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).
Fixed in
4.5.8
What to do
Update the plugin to 4.5.8 or newer.
Full record and what to do →NVD record codecanyon.net wpscan.com
May 6, 2021An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitizationCVE-2021-24243 · WordPress plugins & themes · reported by WPScanMedium 5.4
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.
Fixed in
4.5.6
What to do
Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD record codecanyon.net wpscan.com
Apr 22, 2021Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments: Does not sanitise the invitaion_code GET parameterCVE-2021-24239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
Product
Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments
Fixed in
3.7.0.1
What to do
Update Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments to 3.7.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 12, 2021Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: Did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attributeCVE-2021-24221 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
Product
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for
Fixed in
7.1.12
What to do
Update Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for to 7.1.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 31, 2020An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.CVE-2020-35951 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).
Product
An issue was discovered in the Quiz and Survey Master
Fixed in
7.0.1
What to do
Update An issue was discovered in the Quiz and Survey Master to 7.0.1 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Dec 31, 2020An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.CVE-2020-35949 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the upload, and thus the attacker could use text/plain for a .php file.
Product
An issue was discovered in the Quiz and Survey Master
Fixed in
7.0.1
What to do
Update An issue was discovered in the Quiz and Survey Master to 7.0.1 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Aug 16, 2020php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameCVE-2016-11085 · WordPress plugins & themes · reported by MITREMedium 6.5
php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.
Product
php/qmn_options_questions_tab.php in the quiz-master-next
Fixed in
4.7.9
What to do
Update php/qmn_options_questions_tab.php in the quiz-master-next to 4.7.9 or newer.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Mar 16, 2020be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role viCVE-2020-7916 · WordPress plugins & themes · reported by MITREMedium 6.5
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
Product
LearnPress
Affected
up to 3.2.6.5
What to do
Affects up to 3.2.6.5. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Dec 13, 2019The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS).CVE-2019-17599 · WordPress plugins & themes · reported by MITREMedium 6.1
The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.
Product
quiz-master-next (aka Quiz And Survey Master)
Fixed in
6.3.5
What to do
Update quiz-master-next (aka Quiz And Survey Master) to 6.3.5 or newer.
Full record and what to do →NVD record github.com github.com
Sep 25, 2019The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.CVE-2015-9449 · WordPress plugins & themes · reported by MITREHigh 7.2
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Product
microblog-poster
Fixed in
1.6.2
What to do
Update microblog-poster to 1.6.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.CVE-2016-10996 · WordPress plugins & themes · reported by MITREMedium 5.3
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
Product
optinmonster
Fixed in
1.1.4.6
What to do
Update optinmonster to 1.1.4.6 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Aug 27, 2019The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.CVE-2019-15659 · WordPress plugins & themes · reported by MITRECritical 9.8
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
Product
pie-register
Fixed in
3.1.2
What to do
Update pie-register to 3.1.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.CVE-2018-20979 · WordPress plugins & themes · reported by MITRECritical 9.8
The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.
Product
contact-form-7
Fixed in
5.0.4
What to do
Update contact-form-7 to 5.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jun 10, 2019The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed.CVE-2019-9879 · WordPress plugins & themes · reported by MITRECritical 9.8
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.
Affected
0.2.3 to 0.2.3
What to do
Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Mar 21, 2019The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.CVE-2019-9911 · WordPress plugins & themes · reported by MITREMedium 6.1
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.
Product
social-networks-auto-poster-facebook-twitter-g
Fixed in
4.2.8
What to do
Update social-networks-auto-poster-facebook-twitter-g to 4.2.8 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Mar 5, 2019The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.CVE-2019-9575 · WordPress plugins & themes · reported by MITREMedium 6.1
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.
Affected
6.0.4 to 6.0.4
What to do
Affects 6.0.4 to 6.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com lists.openwall.net
Dec 22, 2018The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.CVE-2018-20368 · WordPress plugins & themes · reported by MITREMedium 5.4
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Jun 17, 2018SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation CVE-2018-10969 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.
Product
SQL injection vulnerability in the Pie Register
Fixed in
3.0.10
What to do
Update SQL injection vulnerability in the Pie Register to 3.0.10 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Feb 6, 2018In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (fromCVE-2018-6389 · WordPress plugins & themes · reported by MITREHigh 7.5
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
Affected
up to 4.9.2
What to do
Affects up to 4.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Dec 6, 2017The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.CVE-2017-17451 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.
Product
WP Mailster
Fixed in
1.5.5
What to do
Update WP Mailster to 1.5.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 27, 2017Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.CVE-2017-14842 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
May 29, 2017Raygun4WP plugin 1.8.0: A reflected XSS in sendtesterrorCVE-2017-9288 · WordPress plugins & themes · reported by MITREMedium 6.1
The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).
Product
Raygun4WP plugin 1.8.0
Affected
1.8.0 to 1.8.0
What to do
Affects 1.8.0 to 1.8.0. Update Raygun4WP plugin 1.8.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jgj212.blogspot.kr github.com
Apr 2, 2017The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not requiCVE-2017-1001000 · WordPress plugins & themes · reported by 46fe6300-5254-4a98-9594-a9567bec8179High 7.5
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
Fixed in
4.7.2
What to do
Update the plugin to 4.7.2 or newer.
Full record and what to do →NVD record openwall.com securitytracker.com
Oct 16, 2015Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to exCVE-2015-7682 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register
Fixed in
2.0.19
What to do
Update Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register to 2.0.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 16, 2015Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to injeCVE-2015-7377 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
Product
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register
Fixed in
2.0.19
What to do
Update Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register to 2.0.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 10, 2015Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web scripCVE-2015-4465 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register
Fixed in
1.1.0
What to do
Update Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jun 10, 2015Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary phpCVE-2015-4153 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
Product
Directory traversal vulnerability in the zM Ajax Login & Register
Fixed in
1.1.0
What to do
Update Directory traversal vulnerability in the zM Ajax Login & Register to 1.1.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jan 23, 2015The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers toCVE-2014-8802 · WordPress plugins & themes · reported by MITREMedium 5
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.
Product
Pie Register
Fixed in
2.0.14
What to do
Update Pie Register to 2.0.14 or newer.
Full record and what to do →NVD record secunia.com security.szurek.pl
Jul 11, 2014SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the idCVE-2014-4938 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php.
Product
WP Rss Poster (wp-rss-poster)
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update WP Rss Poster (wp-rss-poster) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Mar 14, 2014Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcfCVE-2014-2265 · WordPress plugins & themes · reported by MITREMedium 5
Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter.
Fixed in
3.7.2
What to do
Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD record contactform7.com web.archive.org
Jan 3, 2014Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML CVE-2013-6993 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php.
Product
Ad-minister
Affected
up to 0.6
What to do
Affects up to 0.6. Update Ad-minister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org securityfocus.com
Jul 29, 2013Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New RegCVE-2013-4954 · WordPress plugins & themes · reported by MITRELow 2.6
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.
Product
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register
Fixed in
1.31
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register to 1.31 or newer.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.