Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

984 results · page 19 of 20

Jan 16, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack theCVE-2012-6629 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com secunia.com
Jan 16, 2014Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to injeCVE-2012-6627 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
Newsletter Manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 3, 2014Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML CVE-2013-6993 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php.
Product
Ad-minister
Affected
up to 0.6
What to do
Affects up to 0.6. Update Ad-minister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org securityfocus.com
Jan 3, 2014Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows reCVE-2013-6992 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the aafireadcode parameter to wp-admin/options-general.php.
Product
AskApache Firefox Adsense
Affected
up to 3.0
What to do
Affects up to 3.0. Update AskApache Firefox Adsense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org securityfocus.com
Jan 3, 2014Cross-site scripting (XSS) vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script CVE-2013-6991 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php.
Product
WP-Cron Dashboard
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update WP-Cron Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org securityfocus.com
Dec 29, 2013the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier: Cross-site request forgery (CSRF)CVE-2013-7233 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.
Product
the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org osvdb.org
Dec 20, 2013SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via thCVE-2013-7187 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
FormCraft
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Nov 5, 2013The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaCVE-2013-3264 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.4
The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaign.php, which allows remote attackers to modify list or campaign data.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Nov 5, 2013Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to CVE-2013-3263 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid, (11) campaignname, (12) campaignsubject, or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid, (15) campaignname, (16) campaignformat, or (17) action parameter to campaign/updatecampaign.php.
Product
WP Ultimate Email Marketer
What to do
Update WP Ultimate Email Marketer to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Oct 23, 2013SQL injection vulnerability in the Landing Pages plugin 1.2.3, before 20131009, and earlier for WordPress allows remote attackers to execute arbitrary SQL commaCVE-2013-6243 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Landing Pages plugin 1.2.3, before 20131009, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the "post" parameter to index.php.
Product
Landing Pages
Fixed in
20131009
What to do
Update Landing Pages to 20131009 or newer.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Oct 9, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijackCVE-2013-0736 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) modify user privileges or (2) conduct cross-site scripting (XSS) attacks via unspecified vectors.
Product
Mingle Forum
What to do
Update Mingle Forum to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Sep 9, 2013Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WorCVE-2013-5714 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) message parameter. NOTE: some of these details are obtained from third party information.
Product
VideoWhisper Live Streaming Integration
What to do
Update VideoWhisper Live Streaming Integration to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Jul 19, 2013Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and otCVE-2012-3414 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.
Affected
up to 2.2.0.1
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record bot24.blogspot.ca code.google.com
May 10, 2013js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for: Cross-site scripting (XSS)CVE-2013-3526 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter.
Product
js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 11, 2013Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arCVE-2012-6499 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.
Product
Age Verification
Affected
up to 0.4
What to do
Affects up to 0.4. Update Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com osvdb.org
Oct 8, 2012Multiple cross-site scripting (XSS) vulnerabilities in the scr_do_redirect function in scr.php in the Shortcode Redirect plugin 1.0.01 and earlier for WordPressCVE-2012-5325 · WordPress plugins & themes · reported by MITRELow 2.1
Multiple cross-site scripting (XSS) vulnerabilities in the scr_do_redirect function in scr.php in the Shortcode Redirect plugin 1.0.01 and earlier for WordPress allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (1) url or (2) sec attributes in a redirect tag.
Product
Shortcode Redirect
Affected
up to 1.0.01
What to do
Affects up to 1.0.01. Update Shortcode Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers CVE-2011-5194 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter, a different vulnerability than CVE-2011-5193.
Product
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search
Fixed in
1.4.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search to 1.4.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enablCVE-2011-5193 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than CVE-2011-5194.
Product
Whois Search
What to do
Update Whois Search to the newest version.
Full record and what to do →NVD record secunia.com secunia.com
Aug 23, 2012post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for: Cross-site scripting (XSS)CVE-2011-5107 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Product
post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Aug 23, 2012wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for: Cross-site scripting (XSS)CVE-2011-5104 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are obtained from third party information.
Product
wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for
What to do
Update wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for to the newest version.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Jun 16, 2012Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbiCVE-2012-3578 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in html/images.
Product
FCChat Widget
Affected
up to 2.2.13.1
What to do
Affects up to 2.2.13.1. Update FCChat Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
May 3, 2012The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, whichCVE-2012-1936 · WordPress plugins & themes · reported by MITREMedium 6.8
The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Apr 21, 2012Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earCVE-2012-2399 · WordPress plugins & themes · reported by MITREHigh 10
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.
Affected
up to 2.2.0.1
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org jvn.jp
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL databasCVE-2012-0937 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 30, 2012Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attacCVE-2012-0782 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate,CVE-2011-4899 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameteCVE-2011-4898 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com exploit-db.com
Dec 2, 2011wp-users.php in WordPress Users plugin 1.3 and possibly earlier for: SQL injectionCVE-2011-4669 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.
Product
wp-users.php in WordPress Users plugin 1.3 and possibly earlier for
What to do
Update wp-users.php in WordPress Users plugin 1.3 and possibly earlier for to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Sep 13, 2011SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the evCVE-2010-4839 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the event_id parameter in a register action.
Product
Event Registration
Affected
up to 5.32
What to do
Affects up to 5.32. Update Event Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com exploit-db.com
Dec 9, 2010Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject aCVE-2010-4518 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter.
Product
Safe Search
What to do
Update Safe Search to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 6, 2010The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php andCVE-2010-4403 · WordPress plugins & themes · reported by MITREMedium 5
The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message.
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org websecurity.com.ua
Dec 6, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to injectCVE-2010-4402 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.
Product
Register Plus
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Register Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Mar 26, 2010SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQCVE-2009-4748 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
Product
My Category Order
Affected
up to 2.8
What to do
Affects up to 2.8. Update My Category Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org exploit-db.com
Feb 22, 2010SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitCVE-2010-0673 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.
Product
Copperleaf Photolog
What to do
Update Copperleaf Photolog to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Dec 18, 2009Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the searCVE-2009-3703 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.
Product
Multiple SQL injection vulnerabilities in the WP-Forum
Fixed in
2.4
What to do
Update Multiple SQL injection vulnerabilities in the WP-Forum to 2.4 or newer.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Sep 8, 2009wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for: Cross-site scripting (XSS)CVE-2008-7175 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.
Product
wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for
Affected
up to 0.96
What to do
Affects up to 0.96. Update wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org securityfocus.com
Aug 18, 2009WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_heCVE-2009-2852 · WordPress plugins & themes · reported by MITREMedium 6.8
WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.
Affected
up to 0.9.1
What to do
Affects up to 0.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Aug 13, 2009wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, viCVE-2009-2762 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record archives.neohapsis.com core.trac.wordpress.org
May 18, 2009Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitraCVE-2008-6811 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/.
Product
e-Commerce
Affected
up to 3.4
What to do
Affects up to 3.4. Update e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Dec 30, 2008Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allCVE-2008-5752 · WordPress plugins & themes · reported by MITREMedium 4.3
Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details are obtained from third party information.
Product
Page Flip Image Gallery
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update Page Flip Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 19, 2008wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remoteCVE-2008-5695 · WordPress plugins & themes · reported by MITREHigh 8.5
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.
Affected
up to 2.3.2
Fixed in
1.3.2
What to do
Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD record mu.wordpress.org secunia.com
Oct 28, 2008the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5,: Directory traversalCVE-2008-4769 · WordPress plugins & themes · reported by MITREHigh 9.3
Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from third party information.
Product
the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5,
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com trac.wordpress.org
Sep 18, 2008The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain potentially sensitive inCVE-2008-4125 · WordPress plugins & themes · reported by MITREMedium 5
The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain potentially sensitive information, as demonstrated by a cross-application attack against WordPress, a different vulnerability than CVE-2006-0632.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record suspekt.org exchange.xforce.ibmcloud.com
May 21, 2008WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files: Unrestricted file uploadCVE-2008-2392 · WordPress plugins & themes · reported by MITREHigh 9
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
Product
WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityreason.com securityfocus.com
Feb 20, 2008the log feature in the John Godley Search Unleashed 0.2.10 plugin for: Cross-site scripting (XSS)CVE-2008-0837 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the log feature in the John Godley Search Unleashed 0.2.10 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, which is not properly handled when the administrator views the log file.
Product
the log feature in the John Godley Search Unleashed 0.2.10 plugin for
What to do
Update the log feature in the John Godley Search Unleashed 0.2.10 plugin for to the newest version.
Full record and what to do →NVD record secunia.com securityreason.com
Jan 9, 2008Peter's Random Anti-Spam Image 0.2.4 and earlier plugin for: Cross-site scripting (XSS)CVE-2007-6677 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Peter's Random Anti-Spam Image 0.2.4 and earlier plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the comment field in the comment form.
Product
Peter's Random Anti-Spam Image 0.2.4 and earlier plugin for
Affected
up to 0.2.4
What to do
Affects up to 0.2.4. Update Peter's Random Anti-Spam Image 0.2.4 and earlier plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org websecurity.com.ua
Jan 9, 2008Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the popuptiCVE-2008-0192 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the popuptitle parameter to (1) wp-admin/post.php or (2) wp-admin/page-new.php.
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com
Jan 9, 2008wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x,: Cross-site scripting (XSS)CVE-2008-0193 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.
Product
wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x,
Affected
up to 2.3.x
What to do
Affects up to 2.3.x. Update wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk secunia.com
Jan 9, 2008wp-db-backup.php in WordPress 2.0.3 and earlier: Directory traversalCVE-2008-0194 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete arbitrary files, and cause a denial of service via a .. (dot dot) in the backup parameter in a wp-db-backup.php action to wp-admin/edit.php. NOTE: this might be the same as CVE-2006-5705.1.
Product
wp-db-backup.php in WordPress 2.0.3 and earlier
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update wp-db-backup.php in WordPress 2.0.3 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk secunia.com
Jan 9, 2008WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-adCVE-2008-0195 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages.
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.grok.org.uk securityreason.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.