Updated 25 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

143 results · page 2 of 3

Aug 31, 2020An issue was discovered in the Elementor plugin through 2.9.13 for WordPress.CVE-2020-15020 · WordPress plugins & themes · reported by MITREMedium 5.4
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.
Product
An issue was discovered in the Elementor
Affected
up to 2.9.13
What to do
Affects up to 2.9.13. Update An issue was discovered in the Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hidden-one.co.in wordpress.org
Aug 26, 2020An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress.CVE-2020-11497 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step.
Affected
2.1.0 to 2.1.0
What to do
Affects 2.1.0 to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jul 5, 2020An issue was discovered in the Vanguard plugin 2.1 for WordPress.CVE-2020-15537 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box.
Product
Vanguard
Affected
2.1 to 2.1
What to do
Affects 2.1 to 2.1. Update Vanguard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cxsecurity.com packetstormsecurity.com
Jul 5, 2020An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress.CVE-2020-15536 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields.
Product
An issue was discovered in the bestsoftinc Hotel Booking System Pro
Affected
up to 1.1
What to do
Affects up to 1.1. Update An issue was discovered in the bestsoftinc Hotel Booking System Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Jul 5, 2020An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress.CVE-2020-15535 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields.
Product
An issue was discovered in the bestsoftinc Car Rental System
Affected
up to 1.3
What to do
Affects up to 1.3. Update An issue was discovered in the bestsoftinc Car Rental System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Jun 24, 2020An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress.CVE-2020-13700 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.
Product
An issue was discovered in the acf-to-rest-api
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update An issue was discovered in the acf-to-rest-api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com github.com
May 28, 2020An issue was discovered in the Accordion plugin before 2.2.9 for WordPress.CVE-2020-13644 · WordPress plugins & themes · reported by MITREMedium 5.4
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.
Product
An issue was discovered in the Accordion
Fixed in
2.2.9
What to do
Update An issue was discovered in the Accordion to 2.2.9 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
May 28, 2020An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress.CVE-2020-13643 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
Product
An issue was discovered in the SiteOrigin Page Builder
Fixed in
2.10.16
What to do
Update An issue was discovered in the SiteOrigin Page Builder to 2.10.16 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
May 28, 2020An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress.CVE-2020-13642 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
Product
An issue was discovered in the SiteOrigin Page Builder
Fixed in
2.10.16
What to do
Update An issue was discovered in the SiteOrigin Page Builder to 2.10.16 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
May 28, 2020An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress.CVE-2020-13641 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser.
Product
An issue was discovered in the Real-Time Find and Replace
Fixed in
4.0.2
What to do
Update An issue was discovered in the Real-Time Find and Replace to 4.0.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
May 16, 2020An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125.CVE-2020-13126 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.
Product
An issue was discovered in the Elementor Pro
Fixed in
2.9.4
What to do
Update An issue was discovered in the Elementor Pro to 2.9.4 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
May 16, 2020An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-CVE-2020-13125 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.
Product
An issue was discovered in the "Ultimate Addons for Elementor
Fixed in
1.24.2
What to do
Update An issue was discovered in the "Ultimate Addons for Elementor to 1.24.2 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Apr 13, 2020An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress.CVE-2020-11673 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view a hidden poll. This is due to the usage of the callback wp_ajax_nopriv function in Includes/Total-Soft-Poll-Ajax.php for sensitive operations.
Product
An issue was discovered in the Responsive Poll
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update An issue was discovered in the Responsive Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordpress.org
Apr 7, 2020An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress.CVE-2020-9514 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subscriber role) to permanently delete arbitrary posts and pages, create new posts with arbitrary subjects, and modify the subjects of existing posts and pages (via create_dynamic_page and delete_dynamic_page).
Product
An issue was discovered in the IMPress for IDX Broker
Fixed in
2.6.2
What to do
Update An issue was discovered in the IMPress for IDX Broker to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 1, 2020An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.CVE-2020-7948 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.
Product
An issue was discovered in the Login by Auth0
Fixed in
4.0.0
What to do
Update An issue was discovered in the Login by Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com auth0.com
Apr 1, 2020An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.CVE-2020-7947 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.
Product
An issue was discovered in the Login by Auth0
Fixed in
4.0.0
What to do
Update An issue was discovered in the Login by Auth0 to 4.0.0 or newer.
Full record and what to do →NVD record auth0.com auth0.com
Mar 23, 2020An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.CVE-2020-9392 · WordPress plugins & themes · reported by MITREHigh 7.3
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, createFromTpl, and getJSONExportTable endpoints, unauthenticated users can retrieve pricing table information, create new tables, or import/modify a table.
Product
An issue was discovered in the pricing-table-by-supsystic
Fixed in
1.8.2
What to do
Update An issue was discovered in the pricing-table-by-supsystic to 1.8.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 13, 2020An issue was discovered in the File Upload plugin before 4.13.0 for WordPress.CVE-2020-10564 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call.
Product
An issue was discovered in the File Upload
Fixed in
4.13.0
What to do
Update An issue was discovered in the File Upload to 4.13.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Mar 12, 2020XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.CVE-2020-8436 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.
Product
RegistrationMagic
Affected
4.6.0.0 to 4.6.0.0
What to do
Affects 4.6.0.0 to 4.6.0.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record spider-security.co.uk spider-security.co.uk
Mar 12, 2020An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress.CVE-2020-8435 · WordPress plugins & themes · reported by MITREHigh 8.1
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter.
Product
RegistrationMagic
Affected
4.6.0.0 to 4.6.0.0
What to do
Affects 4.6.0.0 to 4.6.0.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record spider-security.co.uk spider-security.co.uk
Feb 25, 2020An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.CVE-2020-9394 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.
Product
An issue was discovered in the pricing-table-by-supsystic
Fixed in
1.8.2
What to do
Update An issue was discovered in the pricing-table-by-supsystic to 1.8.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 25, 2020An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.CVE-2020-9393 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.
Product
An issue was discovered in the pricing-table-by-supsystic
Fixed in
1.8.2
What to do
Update An issue was discovered in the pricing-table-by-supsystic to 1.8.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 24, 2020An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce.CVE-2020-8819 · WordPress plugins & themes · reported by MITREHigh 8.1
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jan 21, 2020An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress.CVE-2016-11018 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone to unauthenticated SQL injection. The affected file is gallery-images.php. The affected function is huge_it_image_gallery_ajax_callback().
Product
An issue was discovered in the Huge-IT gallery-images
Fixed in
1.9.0
What to do
Update An issue was discovered in the Huge-IT gallery-images to 1.9.0 or newer.
Full record and what to do →NVD record 10degres.net plugins.trac.wordpress.org
Dec 30, 2019An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.CVE-2019-20141 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
Product
Laborator Neon
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update Laborator Neon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record knassar702.github.io knassar7o2.blogspot.com
Dec 25, 2019In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered.CVE-2019-19983 · WordPress plugins & themes · reported by MITREMedium 4.3
In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.
Fixed in
2.7.7
What to do
Update the plugin to 2.7.7 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Nov 6, 2019An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress.CVE-2018-20853 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks.
Product
An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters)
Fixed in
2.8.2
What to do
Update An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) to 2.8.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Nov 2, 2019An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator.CVE-2019-18668 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price.
Fixed in
2.11.2
What to do
Update the plugin to 2.11.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 14, 2019An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress.CVE-2019-17574 · WordPress plugins & themes · reported by MITRECritical 9.1
An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").
Product
An issue was discovered in the Popup Maker
Fixed in
1.8.13
What to do
Update An issue was discovered in the Popup Maker to 1.8.13 or newer.
Full record and what to do →NVD record blog.redyops.com github.com
Sep 19, 2019An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress.CVE-2019-16525 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.
Product
An XSS issue was discovered in the checklist
Fixed in
1.1.9
What to do
Update An XSS issue was discovered in the checklist to 1.1.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 13, 2019An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress.CVE-2019-12517 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress backend for all users with at least Subscriber rights. Because the plugin does not properly validate and sanitize this data, a malicious payload in either the name or email field is executed directly within the backend at /wp-admin/admin.php?page=slickquiz across all users with the privileges of at least Subscriber.
Product
An XSS issue was discovered in the slickquiz
Affected
up to 1.3.7.1
What to do
Affects up to 1.3.7.1. Update An XSS issue was discovered in the slickquiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 10, 2019An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress.CVE-2019-15896 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.
Product
An issue was discovered in the LifterLMS
Affected
up to 3.34.5
What to do
Affects up to 3.34.5. Update An issue was discovered in the LifterLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 14, 2019An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress.CVE-2019-14216 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file.
Product
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons)
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com zeroauth.ltd
Jul 21, 2019An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress.CVE-2019-14231 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.
Product
An issue was discovered in the Viral Quiz Maker - OnionBuzz
Fixed in
1.2.2
What to do
Update An issue was discovered in the Viral Quiz Maker - OnionBuzz to 1.2.2 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Jul 21, 2019An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress.CVE-2019-14230 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.
Product
An issue was discovered in the Viral Quiz Maker - OnionBuzz
Fixed in
1.2.7
What to do
Update An issue was discovered in the Viral Quiz Maker - OnionBuzz to 1.2.7 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Jul 19, 2019An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress.CVE-2019-12934 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
Product
An issue was discovered in the wp-code-highlightjs
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update An issue was discovered in the wp-code-highlightjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com wordpress.org
Jul 4, 2019An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress.CVE-2019-13275 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.
Product
An issue was discovered in the VeronaLabs wp-statistics
Fixed in
12.6.7
What to do
Update An issue was discovered in the VeronaLabs wp-statistics to 12.6.7 or newer.
Full record and what to do →NVD record github.com wordpress.org
Jun 24, 2019An issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10271 · WordPress plugins & themes · reported by MITREMedium 4.3
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.
Product
Ultimate Member
Fixed in
2.0.40
What to do
Update Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jun 21, 2019An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10270 · WordPress plugins & themes · reported by MITREHigh 8.8
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation.
Product
Ultimate Member
Fixed in
2.0.40
What to do
Update Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jun 19, 2019An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress.CVE-2018-16613 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction.
Product
An issue was discovered in the update function in the wpForo Forum
Fixed in
1.5.2
What to do
Update An issue was discovered in the update function in the wpForo Forum to 1.5.2 or newer.
Full record and what to do →NVD record github.com github.com
Jun 10, 2019An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress.CVE-2019-9880 · WordPress plugins & themes · reported by MITRECritical 9.1
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
Affected
0.2.3 to 0.2.3
What to do
Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Mar 21, 2019The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key, CVE-2018-20555 · WordPress plugins & themes · reported by MITRECritical 9.8
The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key, and consumer_secret values by reading the dcwp_twitter.php source code. This leads to Twitter account takeover.
Affected
1.7.1 to 1.7.1
What to do
Affects 1.7.1 to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com twitter.com
Dec 25, 2018An issue was discovered in the JSmol2WP plugin 1.07 for WordPress.CVE-2018-20463 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF.
Product
JSmol2WP
Affected
1.07 to 1.07
What to do
Affects 1.07 to 1.07. Update JSmol2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com cbiu.cc
Dec 25, 2018An issue was discovered in the JSmol2WP plugin 1.07 for WordPress.CVE-2018-20462 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter.
Product
JSmol2WP
Affected
1.07 to 1.07
What to do
Affects 1.07 to 1.07. Update JSmol2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com cbiu.cc
Dec 14, 2018The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.CVE-2018-20154 · WordPress plugins & themes · reported by MITREMedium 4.3
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
Product
WP Maintenance Mode
Fixed in
2.0.7
What to do
Update WP Maintenance Mode to 2.0.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Nov 26, 2018Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress.CVE-2018-19564 · WordPress plugins & themes · reported by MITREMedium 6.1
Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.
Product
Easy Testimonials
Affected
3.2 to 3.2
What to do
Affects 3.2 to 3.2. Update Easy Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 17, 2018In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the ChatCVE-2018-18373 · WordPress plugins & themes · reported by MITREMedium 5.4
In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sb_ajax_add_message action.
Product
Schiocco "Support Board - Chat And Help Desk
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update Schiocco "Support Board - Chat And Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Aug 26, 2018An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress.CVE-2018-15876 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished by automation.
Product
ajax-bootmodal-login
What to do
Update ajax-bootmodal-login to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 18, 2018A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress.CVE-2018-12534 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress.
Product
A SQL injection issue was discovered in the Quick Chat
Fixed in
4.00
What to do
Update A SQL injection issue was discovered in the Quick Chat to 4.00 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jun 13, 2018An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress.CVE-2018-10363 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.
Product
WpDevArt "Booking calendar, Appointment Booking System
Affected
2.2.2 to 2.2.2
What to do
Affects 2.2.2 to 2.2.2. Update WpDevArt "Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com gist.github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.