Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

349new WordPress flaws this week

393,576entries in the database

9,138 results · page 178 of 183

Sep 17, 2019The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.CVE-2016-10981 · WordPress plugins & themes · reported by MITREMedium 6.1
The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.
Product
kento-post-view-counter
Affected
up to 2.8
What to do
Affects up to 2.8. Update kento-post-view-counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org openwall.com
Sep 17, 2019The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.CVE-2016-10977 · WordPress plugins & themes · reported by MITREMedium 6.5
The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
Product
nelio-ab-testing
Fixed in
4.5.0
What to do
Update nelio-ab-testing to 4.5.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 17, 2019The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.CVE-2016-10976 · WordPress plugins & themes · reported by MITREMedium 6.1
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
Product
safe-editor
Fixed in
1.2
What to do
Update safe-editor to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 17, 2019The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.CVE-2016-10974 · WordPress plugins & themes · reported by MITREHigh 8.8
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
Product
fluid-responsive-slideshow
Fixed in
2.2.7
What to do
Update fluid-responsive-slideshow to 2.2.7 or newer.
Full record and what to do →NVD record klikki.fi wordpress.org
Sep 16, 2019The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.CVE-2016-10966 · WordPress plugins & themes · reported by MITREHigh 7.5
The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mukarramkhalid.com wordpress.org
Sep 16, 2019The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.CVE-2016-10965 · WordPress plugins & themes · reported by MITREHigh 7.5
The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mukarramkhalid.com wordpress.org
Sep 13, 2019The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.CVE-2016-10944 · WordPress plugins & themes · reported by MITREHigh 8.8
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
Product
multisite-post-duplicator
Fixed in
1.1.3
What to do
Update multisite-post-duplicator to 1.1.3 or newer.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 13, 2019The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.CVE-2016-10939 · WordPress plugins & themes · reported by MITREHigh 7.2
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 11, 2019WordPress before 5.2.3 allows XSS in stored comments.CVE-2019-16218 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows XSS in stored comments.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record lists.debian.org seclists.org
Sep 10, 2019The avada theme before 5.1.5 for WordPress has stored XSS.CVE-2017-18606 · WordPress plugins & themes · reported by MITREMedium 6.1
The avada theme before 5.1.5 for WordPress has stored XSS.
Product
avada
Fixed in
5.1.5
What to do
Update avada to 5.1.5 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 10, 2019The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.CVE-2017-18600 · WordPress plugins & themes · reported by MITREMedium 5.4
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
Product
formcraft3
Fixed in
3.4
What to do
Update formcraft3 to 3.4 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 10, 2019The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.CVE-2017-18596 · WordPress plugins & themes · reported by MITREHigh 8.8
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
Product
elementor
Fixed in
1.8.0
What to do
Update elementor to 1.8.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 9, 2019The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.CVE-2018-21014 · WordPress plugins & themes · reported by MITREMedium 5.4
The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.
Product
buddyboss-media
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update buddyboss-media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 9, 2019The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath toCVE-2018-21013 · WordPress plugins & themes · reported by MITRECritical 9.8
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.
Product
Swape
Fixed in
1.2.1
What to do
Update Swape to 1.2.1 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 3, 2019The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.CVE-2019-15870 · WordPress plugins & themes · reported by MITREMedium 5.4
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
Product
CarSpot
Fixed in
2.1.7
What to do
Update CarSpot to 2.1.7 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 3, 2019The JobCareer theme before 2.5.1 for WordPress has stored XSS.CVE-2019-15869 · WordPress plugins & themes · reported by MITREMedium 5.4
The JobCareer theme before 2.5.1 for WordPress has stored XSS.
Product
JobCareer
Fixed in
2.5.1
What to do
Update JobCareer to 2.5.1 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Aug 30, 2019The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.CVE-2019-15839 · WordPress plugins & themes · reported by MITREHigh 7.5
The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.
Product
sina-extension-for-elementor
Fixed in
2.2.1
What to do
Update sina-extension-for-elementor to 2.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The webp-express plugin before 0.14.8 for WordPress has stored XSS.CVE-2019-15837 · WordPress plugins & themes · reported by MITREMedium 5.4
The webp-express plugin before 0.14.8 for WordPress has stored XSS.
Product
webp-express
Fixed in
0.14.8
What to do
Update webp-express to 0.14.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.CVE-2019-15836 · WordPress plugins & themes · reported by MITREMedium 5.4
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.
Product
wp-ultimate-recipe
Fixed in
3.12.7
What to do
Update wp-ultimate-recipe to 3.12.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.CVE-2019-15832 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
Product
visitors-traffic-real-time-statistics
Fixed in
1.13
What to do
Update visitors-traffic-real-time-statistics to 1.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.CVE-2019-15831 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
Product
visitors-traffic-real-time-statistics
Fixed in
1.12
What to do
Update visitors-traffic-real-time-statistics to 1.12 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.CVE-2019-15822 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.
Product
wps-child-theme-generator
Fixed in
1.2
What to do
Update wps-child-theme-generator to 1.2 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 28, 2019The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9362 · WordPress plugins & themes · reported by MITREMedium 6.1
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Post Connector
Fixed in
1.0.4
What to do
Update Post Connector to 1.0.4 or newer.
Full record and what to do →NVD record barrykooij.com barrykooij.com
Aug 28, 2019The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.CVE-2015-9355 · WordPress plugins & themes · reported by MITREMedium 6.1
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Product
two-factor-authentication
Fixed in
1.1.10
What to do
Update two-factor-authentication to 1.1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.CVE-2017-18592 · WordPress plugins & themes · reported by MITREHigh 7.5
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
Product
woocommerce-catalog-enquiry
Fixed in
3.1.0
What to do
Update woocommerce-catalog-enquiry to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.CVE-2019-15644 · WordPress plugins & themes · reported by MITREMedium 6.1
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
Product
zoho-salesiq
Fixed in
1.0.9
What to do
Update zoho-salesiq to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.CVE-2015-9349 · WordPress plugins & themes · reported by MITREMedium 6.1
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
Product
ckeditor-for-wordpress
Fixed in
4.5.3.1
What to do
Update ckeditor-for-wordpress to 4.5.3.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-15326 · WordPress plugins & themes · reported by MITREHigh 7.5
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
Product
import-users-from-csv-with-meta
Fixed in
1.14.2.1
What to do
Update import-users-from-csv-with-meta to 1.14.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.CVE-2017-18585 · WordPress plugins & themes · reported by MITREHigh 8.1
The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.
Product
posts-in-page
Fixed in
1.3.0
What to do
Update posts-in-page to 1.3.0 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 22, 2019The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.CVE-2017-18586 · WordPress plugins & themes · reported by MITRECritical 9.1
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.
Product
insert-pages
Fixed in
3.2.4
What to do
Update insert-pages to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.CVE-2014-10390 · WordPress plugins & themes · reported by MITRECritical 9.1
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-15322 · WordPress plugins & themes · reported by MITRECritical 9.8
The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.
Product
shortcode-factory
Fixed in
2.8
What to do
Update shortcode-factory to 2.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ebook-download plugin before 1.2 for WordPress has directory traversal.CVE-2016-10924 · WordPress plugins & themes · reported by MITREHigh 7.5
The ebook-download plugin before 1.2 for WordPress has directory traversal.
Product
ebook-download
Fixed in
1.2
What to do
Update ebook-download to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.CVE-2016-10923 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
Product
woocommerce-store-toolkit
Fixed in
1.5.8
What to do
Update woocommerce-store-toolkit to 1.5.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.CVE-2016-10922 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
Product
woocommerce-store-toolkit
Fixed in
1.5.7
What to do
Update woocommerce-store-toolkit to 1.5.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.CVE-2017-18575 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
Product
newstatpress
Fixed in
1.2.5
What to do
Update newstatpress to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.CVE-2009-5158 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.
Product
google-analyticator
Fixed in
5.2.1
What to do
Update google-analyticator to 5.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.CVE-2017-18537 · WordPress plugins & themes · reported by MITREMedium 6.1
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
Product
visitors-online
Fixed in
1.0.0
What to do
Update visitors-online to 1.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The seo-redirection plugin before 4.3 for WordPress has stored XSS.CVE-2016-10896 · WordPress plugins & themes · reported by MITREMedium 6.1
The seo-redirection plugin before 4.3 for WordPress has stored XSS.
Product
seo-redirection
Fixed in
4.3
What to do
Update seo-redirection to 4.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.CVE-2015-9321 · WordPress plugins & themes · reported by MITREMedium 6.1
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Product
shortcode-factory
Fixed in
1.1.1
What to do
Update shortcode-factory to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.CVE-2019-15113 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
Product
companion-sitemap-generator
Fixed in
3.7.0
What to do
Update companion-sitemap-generator to 3.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The visitors-online plugin before 0.4 for WordPress has SQL injection.CVE-2015-9325 · WordPress plugins & themes · reported by MITRECritical 9.8
The visitors-online plugin before 0.4 for WordPress has SQL injection.
Product
visitors-online
Fixed in
0.4
What to do
Update visitors-online to 0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultCVE-2019-14788 · WordPress plugins & themes · reported by MITREHigh 8.8
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
Product
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters
Fixed in
4.6.19
What to do
Update wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress.CVE-2019-14216 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file.
Product
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons)
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com zeroauth.ltd
Aug 14, 2019The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.CVE-2016-10886 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
Product
wp-editor
Fixed in
1.2.6
What to do
Update wp-editor to 1.2.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-editor plugin before 1.2.6 for WordPress has CSRF.CVE-2016-10885 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
Product
wp-editor
Fixed in
1.2.6
What to do
Update wp-editor to 1.2.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The google-language-translator plugin before 5.0.06 for WordPress has XSS.CVE-2016-10870 · WordPress plugins & themes · reported by MITREMedium 6.1
The google-language-translator plugin before 5.0.06 for WordPress has XSS.
Product
google-language-translator
Fixed in
5.0.06
What to do
Update google-language-translator to 5.0.06 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.CVE-2015-9296 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Product
download-monitor
Fixed in
1.7.1
What to do
Update download-monitor to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.CVE-2016-10877 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
Product
wp-editor
Fixed in
1.2.6.3
What to do
Update wp-editor to 1.2.6.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=CVE-2019-14798 · WordPress plugins & themes · reported by MITREMedium 4.9
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
Product
10Web Photo Gallery
Fixed in
1.5.25
What to do
Update 10Web Photo Gallery to 1.5.25 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.