Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,126 results · page 17 of 23

Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.CVE-2019-16118 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.CVE-2019-16117 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 3, 2019The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with theCVE-2019-15873 · WordPress plugins & themes · reported by MITREHigh 8.8
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.
Product
profilegrid-user-profiles-groups-and-communities
Fixed in
2.8.6
What to do
Update profilegrid-user-profiles-groups-and-communities to 2.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Product
admin/includes/class.import.snippet.php in the "Woody ad snippets
Fixed in
2.2.5
What to do
Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Aug 30, 2019The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.CVE-2019-15829 · WordPress plugins & themes · reported by MITREMedium 4.8
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
Product
photoblocks-grid-gallery
Fixed in
1.1.33
What to do
Update photoblocks-grid-gallery to 1.1.33 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.CVE-2019-15824 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
Product
wps-hide-login
Fixed in
1.5.3
What to do
Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 29, 2019The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.CVE-2019-15777 · WordPress plugins & themes · reported by MITREMedium 5.4
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
Product
shapepress-dsgvo
Fixed in
2.2.19
What to do
Update shapepress-dsgvo to 2.2.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 28, 2019The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.CVE-2015-9355 · WordPress plugins & themes · reported by MITREMedium 6.1
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Product
two-factor-authentication
Fixed in
1.1.10
What to do
Update two-factor-authentication to 1.1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.CVE-2015-9353 · WordPress plugins & themes · reported by MITREHigh 7.2
The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Product
gigpress
Fixed in
2.3.11
What to do
Update gigpress to 2.3.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.CVE-2011-5329 · WordPress plugins & themes · reported by MITREMedium 6.1
The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.
Product
redirection
Fixed in
2.2.9
What to do
Update redirection to 2.2.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.CVE-2019-15647 · WordPress plugins & themes · reported by MITREHigh 8.8
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
Product
groundhogg
Fixed in
1.3.5
What to do
Update groundhogg to 1.3.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-15318 · WordPress plugins & themes · reported by MITRECritical 9.8
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
Product
yikes-inc-easy-mailchimp-extender
Fixed in
6.5.3
What to do
Update yikes-inc-easy-mailchimp-extender to 6.5.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.CVE-2018-20982 · WordPress plugins & themes · reported by MITREMedium 6.1
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
Product
media-library-assistant
Fixed in
2.74
What to do
Update media-library-assistant to 2.74 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.CVE-2013-7480 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
Product
events-manager
Fixed in
5.3.6.1
What to do
Update events-manager to 5.3.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.CVE-2017-18521 · WordPress plugins & themes · reported by MITREHigh 8.8
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
Product
democracy-poll
Fixed in
5.4
What to do
Update democracy-poll to 5.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 21, 2019The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.CVE-2016-10902 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
Product
wp-customer-reviews
Fixed in
3.0.9
What to do
Update wp-customer-reviews to 3.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.CVE-2016-10901 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
Product
wp-customer-reviews
Fixed in
3.0.9
What to do
Update wp-customer-reviews to 3.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.CVE-2017-18519 · WordPress plugins & themes · reported by MITREMedium 6.1
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
Product
customer-area
Fixed in
7.4.3
What to do
Update customer-area to 7.4.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.CVE-2017-18520 · WordPress plugins & themes · reported by MITREMedium 6.1
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
Product
democracy-poll
Fixed in
5.4
What to do
Update democracy-poll to 5.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 20, 2019The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.CVE-2015-9332 · WordPress plugins & themes · reported by MITREMedium 6.5
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Product
uninstall
Fixed in
1.2
What to do
Update uninstall to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Product
wp-all-import
Fixed in
3.2.4
What to do
Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.CVE-2018-20971 · WordPress plugins & themes · reported by MITREHigh 8.8
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
Product
church-admin
Fixed in
1.2550
What to do
Update church-admin to 1.2550 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.CVE-2017-18544 · WordPress plugins & themes · reported by MITREHigh 8.8
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.CVE-2019-14789 · WordPress plugins & themes · reported by MITREMedium 6.1
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
Affected
3.2.8 to 3.2.8
What to do
Affects 3.2.8 to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 15, 2019wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultCVE-2019-14788 · WordPress plugins & themes · reported by MITREHigh 8.8
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
Product
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters
Fixed in
4.6.19
What to do
Update wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.CVE-2019-14786 · WordPress plugins & themes · reported by MITREMedium 6.5
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.
Fixed in
1.0.27.1
What to do
Update the plugin to 1.0.27.1 or newer.
Full record and what to do →NVD record rankmath.com wpvulndb.com
Aug 15, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-pCVE-2019-14800 · WordPress plugins & themes · reported by MITREMedium 5.3
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.
Product
FV Flowplayer Video Player
Fixed in
7.3.15.727
What to do
Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 15, 2019The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked CVE-2019-14795 · WordPress plugins & themes · reported by MITREMedium 4.8
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,CVE-2019-14790 · WordPress plugins & themes · reported by MITREMedium 6.1
The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.CVE-2017-18513 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
Product
responsive-menu
Fixed in
3.1.4
What to do
Update responsive-menu to 3.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.CVE-2013-7476 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
Product
simple-fields
Fixed in
1.2
What to do
Update simple-fields to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameterCVE-2015-9316 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Product
wp-fastest-cache
Fixed in
0.8.4.9
What to do
Update wp-fastest-cache to 0.8.4.9 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Aug 13, 2019The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.CVE-2017-18493 · WordPress plugins & themes · reported by MITREMedium 6.1
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
Product
custom-admin-page
Fixed in
0.1.2
What to do
Update custom-admin-page to 0.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=CVE-2019-14798 · WordPress plugins & themes · reported by MITREMedium 4.9
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
Product
10Web Photo Gallery
Fixed in
1.5.25
What to do
Update 10Web Photo Gallery to 1.5.25 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?actioCVE-2019-14796 · WordPress plugins & themes · reported by MITREMedium 5.4
The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.CVE-2019-14791 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
Affected
1.3.18 to 1.3.18
What to do
Affects 1.3.18 to 1.3.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.CVE-2019-14793 · WordPress plugins & themes · reported by MITREMedium 6.5
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
Product
Meta Box
Fixed in
4.16.3
What to do
Update Meta Box to 4.16.3 or newer.
Full record and what to do →NVD record metabox.io pluginvulnerabilities.com
Aug 9, 2019The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.CVE-2019-14792 · WordPress plugins & themes · reported by MITREMedium 5.4
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
Product
WP Google Maps
Fixed in
7.11.35
What to do
Update WP Google Maps to 7.11.35 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameterCVE-2019-14787 · WordPress plugins & themes · reported by MITREMedium 5.4
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
Product
Tribulant Newsletters
Fixed in
4.6.19
What to do
Update Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.phpCVE-2019-14785 · WordPress plugins & themes · reported by MITREMedium 5.4
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
Product
CP Contact Form with PayPal
Fixed in
1.2.99
What to do
Update CP Contact Form with PayPal to 1.2.99 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 9, 2019The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated byCVE-2016-10865 · WordPress plugins & themes · reported by MITREMedium 6.1
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
Product
Lightbox Plus Colorbox
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Lightbox Plus Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatcheCVE-2019-14774 · WordPress plugins & themes · reported by MITREMedium 6.1
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
Affected
1.0.61 to 1.0.61
What to do
Affects 1.0.61 to 1.0.61. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Aug 8, 2019admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletioCVE-2019-14773 · WordPress plugins & themes · reported by MITREHigh 7.5
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
Product
admin/includes/class.actions.snippet.php in the "Woody ad snippets
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update admin/includes/class.actions.snippet.php in the "Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Product
codection "Import users from CSV with meta
Fixed in
1.14.2.2
What to do
Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 8, 2019The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.CVE-2019-14682 · WordPress plugins & themes · reported by MITREMedium 4.3
The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
Product
acf-better-search (aka ACF: Better Search)
Fixed in
3.3.1
What to do
Update acf-better-search (aka ACF: Better Search) to 3.3.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 8, 2019The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.CVE-2019-14681 · WordPress plugins & themes · reported by MITREHigh 8.8
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
Product
Deny All Firewall
Fixed in
1.1.7
What to do
Update Deny All Firewall to 1.1.7 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 8, 2019The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.CVE-2019-14680 · WordPress plugins & themes · reported by MITREMedium 5.7
The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
Affected
3.2.1 to 3.2.1
What to do
Affects 3.2.1 to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Aug 8, 2019core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.CVE-2019-14679 · WordPress plugins & themes · reported by MITREMedium 6.5
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
Product
ARPrice Lite
Affected
2.2 to 2.2
What to do
Affects 2.2 to 2.2. Update ARPrice Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Jul 18, 2019The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.CVE-2016-10763 · WordPress plugins & themes · reported by MITREMedium 4.8
The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.
Product
CampTix Event Ticketing
Fixed in
1.5
What to do
Update CampTix Event Ticketing to 1.5 or newer.
Full record and what to do →NVD record hackerone.com wordpress.org
Jun 15, 2019The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.CVE-2013-7472 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
Product
Count per Day
Fixed in
3.2.6
What to do
Update Count per Day to 3.2.6 or newer.
Full record and what to do →NVD record lists.openwall.net wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.