Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

279new WordPress flaws this week

393,576entries in the database

9,271 results · page 184 of 186

Sep 26, 2019The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to impCVE-2019-16524 · WordPress plugins & themes · reported by MITREMedium 4.8
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.
Product
easy-fancybox
Fixed in
1.8.18
What to do
Update easy-fancybox to 1.8.18 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 25, 2019The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGCVE-2015-9423 · WordPress plugins & themes · reported by MITREMedium 5.4
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters.
Product
PlugNedit Adaptive Editor
Fixed in
6.2.0
What to do
Update PlugNedit Adaptive Editor to 6.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_diaCVE-2015-9422 · WordPress plugins & themes · reported by MITREMedium 6.5
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters.
Product
PlugNedit Adaptive Editor
Fixed in
6.2.0
What to do
Update PlugNedit Adaptive Editor to 6.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 12, 2019WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier: Cross-site request forgery (CSRF)CVE-2019-5992 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier
Affected
up to 4.4
What to do
Affects up to 4.4. Update WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp jvn.jp
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-15872 · WordPress plugins & themes · reported by MITRECritical 9.8
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Sep 3, 2019The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.CVE-2019-15866 · WordPress plugins & themes · reported by MITREHigh 8.8
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.
Product
crelly-slider
Fixed in
1.3.5
What to do
Update crelly-slider to 1.3.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Product
admin/includes/class.import.snippet.php in the "Woody ad snippets
Fixed in
2.2.5
What to do
Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Aug 30, 2019The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.CVE-2019-15833 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
Product
simple-mail-address-encoder
Fixed in
1.7
What to do
Update simple-mail-address-encoder to 1.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.CVE-2019-15821 · WordPress plugins & themes · reported by MITREHigh 7.5
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Product
bold-page-builder
Fixed in
2.3.2
What to do
Update bold-page-builder to 2.3.2 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15819 · WordPress plugins & themes · reported by MITRECritical 9.8
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Product
nd-restaurant-reservations
Fixed in
1.5
What to do
Update nd-restaurant-reservations to 1.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301CVE-2019-15818 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
Product
simple-301-redirects-addon-bulk-uploader
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update simple-301-redirects-addon-bulk-uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 29, 2019The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.CVE-2019-15776 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
Product
simple-301-redirects-addon-bulk-uploader
Fixed in
1.2.5
What to do
Update simple-301-redirects-addon-bulk-uploader to 1.2.5 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 23, 2019The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name,CVE-2019-15092 · WordPress plugins & themes · reported by MITREHigh 7.3
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.CVE-2019-15329 · WordPress plugins & themes · reported by MITREHigh 8.8
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.CVE-2019-15328 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-15327 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
Product
import-users-from-csv-with-meta
Fixed in
1.14.1.3
What to do
Update import-users-from-csv-with-meta to 1.14.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-15326 · WordPress plugins & themes · reported by MITREHigh 7.5
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
Product
import-users-from-csv-with-meta
Fixed in
1.14.2.1
What to do
Update import-users-from-csv-with-meta to 1.14.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.CVE-2017-18577 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
Product
mailchimp-for-wp
Fixed in
4.1.8
What to do
Update mailchimp-for-wp to 4.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-15318 · WordPress plugins & themes · reported by MITRECritical 9.8
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
Product
yikes-inc-easy-mailchimp-extender
Fixed in
6.5.3
What to do
Update yikes-inc-easy-mailchimp-extender to 6.5.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18573 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.4.7 for WordPress has XSS.CVE-2018-20978 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.7
What to do
Update wp-all-import to 3.4.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.4.6 for WordPress has XSS.CVE-2017-18567 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.6
What to do
Update wp-all-import to 3.4.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.CVE-2016-10914 · WordPress plugins & themes · reported by MITREHigh 8.8
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
Product
add-from-server
Fixed in
3.3.2
What to do
Update add-from-server to 3.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Product
wp-all-import
Fixed in
3.2.4
What to do
Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.CVE-2015-9330 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.CVE-2015-9329 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress.CVE-2019-13578 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Product
A SQL injection vulnerability exists in the Impress GiveWP Give
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update A SQL injection vulnerability exists in the Impress GiveWP Give to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Aug 14, 2019The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.CVE-2018-20967 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
Product
wp-ultimate-csv-importer
Fixed in
5.6.1
What to do
Update wp-ultimate-csv-importer to 5.6.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.CVE-2016-10884 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Product
simple-membership
Fixed in
3.3.3
What to do
Update simple-membership to 3.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.CVE-2016-10883 · WordPress plugins & themes · reported by MITREMedium 6.5
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
Product
simple-add-pages-or-posts
Fixed in
1.7
What to do
Update simple-add-pages-or-posts to 1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.CVE-2013-7476 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
Product
simple-fields
Fixed in
1.2
What to do
Update simple-fields to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18514 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.CVE-2017-18498 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
Product
simple-job-board
Fixed in
2.4.4
What to do
Update simple-job-board to 2.4.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.CVE-2016-10871 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
Product
mailchimp-for-wp
Fixed in
4.0.11
What to do
Update mailchimp-for-wp to 4.0.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The simple-fields plugin before 1.4.11 for WordPress has XSS.CVE-2015-9302 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-fields plugin before 1.4.11 for WordPress has XSS.
Product
simple-fields
Fixed in
1.4.11
What to do
Update simple-fields to 1.4.11 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The simple-membership plugin before 3.5.7 for WordPress has XSS.CVE-2017-18499 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-membership plugin before 3.5.7 for WordPress has XSS.
Product
simple-membership
Fixed in
3.5.7
What to do
Update simple-membership to 3.5.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.CVE-2015-9303 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Product
simple-share-buttons-adder
Fixed in
6.0.0
What to do
Update simple-share-buttons-adder to 6.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.CVE-2019-14948 · WordPress plugins & themes · reported by MITREMedium 5.4
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
Product
woocommerce-product-addon
Fixed in
18.4
What to do
Update woocommerce-product-addon to 18.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.CVE-2015-9306 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
Product
wp-ultimate-csv-importer
Fixed in
3.8.1
What to do
Update wp-ultimate-csv-importer to 3.8.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Product
codection "Import users from CSV with meta
Fixed in
1.14.2.2
What to do
Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 8, 2019core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.CVE-2019-14679 · WordPress plugins & themes · reported by MITREMedium 6.5
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
Product
ARPrice Lite
Affected
2.2 to 2.2
What to do
Affects 2.2 to 2.2. Update ARPrice Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Jul 30, 2019A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.CVE-2019-14327 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
Product
Custom Simple Rss
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Custom Simple Rss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 28, 2019The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.CVE-2019-14328 · WordPress plugins & themes · reported by MITREHigh 8.8
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
Product
Simple Membership
Fixed in
3.8.5
What to do
Update Simple Membership to 3.8.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16259 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16258 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template.CVE-2018-16257 · WordPress plugins & themes · reported by MITREMedium 6.1
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16256 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16255 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16254 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.