Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
61 results · page 2 of 2
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated userCVE-2022-24663 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated user.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jan 24, 2022Code Snippets: Does not escape the snippets-safe-mode parameter before outputting it back in attributesCVE-2021-25008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue
- Product
- Code Snippets
- Fixed in
- 2.14.3
- What to do
- Update Code Snippets to 2.14.3 or newer.
Jan 28, 2020The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.CVE-2020-8417 · WordPress plugins & themes · reported by MITREHigh 8.8
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.
- Product
- Code Snippets
- Fixed in
- 2.14.0
- What to do
- Update Code Snippets to 2.14.0 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Sep 13, 2019The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.CVE-2019-16289 · WordPress plugins & themes · reported by MITREMedium 5.4
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
- Product
- insert-php (aka Woody ad snippets)
- Fixed in
- 2.2.8
- What to do
- Update insert-php (aka Woody ad snippets) to 2.2.8 or newer.
Full record and what to do →NVD recordgeneraleg0x01.comwordpress.org
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
- Product
- admin/includes/class.import.snippet.php in the "Woody ad snippets
- Fixed in
- 2.2.5
- What to do
- Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD recordblog.nintechnet.comwpvulndb.com
Aug 21, 2019The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.CVE-2018-20977 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
- Product
- all-in-one-schemaorg-rich-snippets
- Fixed in
- 1.5.0
- What to do
- Update all-in-one-schemaorg-rich-snippets to 1.5.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 8, 2019admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletioCVE-2019-14773 · WordPress plugins & themes · reported by MITREHigh 7.5
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
- Product
- admin/includes/class.actions.snippet.php in the "Woody ad snippets
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update admin/includes/class.actions.snippet.php in the "Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not CVE-2017-1002012 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement.
- Affected
- 1.5.2 to 1.5.2
- What to do
- Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Feb 28, 2008modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for: PHP remote file inclusionCVE-2008-1059 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.
- Product
- modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for
- What to do
- Update modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for to the newest version.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Feb 28, 2008Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script oCVE-2008-1061 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Feb 28, 2008modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for: Eval injectionCVE-2008-1060 · WordPress plugins & themes · reported by MITREHigh 7.5
Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text parameter.
- Product
- modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for
- What to do
- Update modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for to the newest version.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.