Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

439new WordPress flaws this week

394,398entries in the database

11,390 results · page 227 of 228

Oct 6, 2016Open Proxy in filedownload v1.4 wordpress pluginCVE-2015-1000002 · WordPress plugins & themes · reported by MITREHigh 8.2
Open Proxy in filedownload v1.4 wordpress plugin
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.CVE-2016-5839 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.CVE-2016-5836 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jun 4, 2016Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web scriCVE-2016-4812 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved
Fixed in
2.5.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved to 2.5.1 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Sep 15, 2015Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via CVE-2015-5472 · WordPress plugins & themes · reported by MITREHigh 7.8
Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Product
Absolute path traversal vulnerability in lib/download.php in the IBS Mappro
Fixed in
1.0
What to do
Update Absolute path traversal vulnerability in lib/download.php in the IBS Mappro to 1.0 or newer.
Full record and what to do →NVD record vapid.dhs.org wordpress.org
Aug 31, 2015Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators toCVE-2015-6535 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
Product
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed
Fixed in
3.3.3
What to do
Update Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 3, 2015WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and crCVE-2015-5623 · WordPress plugins & themes · reported by MITREMedium 4
WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record codex.wordpress.org openwall.com
Jun 30, 2015The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restricCVE-2014-9735 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
Product
ThemePunch Slider Revolution (revslider)
Affected
up to 1.7.1
Fixed in
3.0.96
What to do
Update ThemePunch Slider Revolution (revslider) to 3.0.96 or newer.
Full record and what to do →NVD record seclists.org securityfocus.com
Jun 24, 2015Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WoCVE-2015-5065 · WordPress plugins & themes · reported by MITREMedium 5
Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter.
Fixed in
1.4
What to do
Update the plugin to 1.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain seCVE-2014-8607 · WordPress plugins & themes · reported by MITRELow 2.1
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command.
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
May 14, 2015Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WorCVE-2015-3300 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2) billing_lastname, (3) billing_company, (4) billing_tax_id_number, (5) billing_city, (6) billing_street, (7) billing_street_2, (8) billing_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shipping_lastname, (14) shipping_company, (15) shipping_tax_id_number, (16) shipping_city, (17) shipping_street, (18) shipping_street_2, (19) shipping_postcode, (20) shipping_telephone_1, (21) shipping_telephone_2, or (22) shipping_fax parameter to shopping-cart/checkout/; the (23) search_by parameter in the admin/AddressesList.php page to wp-admin/admin.php; the (24) address_id, (25) address_name, (26) firstname, (27) lastname, (28) street, (29) city, (30) postcode, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type parameter in the admin/AssignedCategoriesList.php page to wp-admin/admin.php; or the (3
Fixed in
1.3.9.3
What to do
Update the plugin to 1.3.9.3 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Apr 3, 2015The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta DescriptCVE-2015-0902 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.
Product
Semper Fi All in One SEO Pack
Fixed in
2.2.6
What to do
Update Semper Fi All in One SEO Pack to 2.2.6 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 30, 2015The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perfCVE-2015-2792 · WordPress plugins & themes · reported by MITREHigh 7.5
The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.
Product
WPML
Fixed in
3.1.9
What to do
Update WPML to 3.1.9 or newer.
Full record and what to do →NVD record klikki.fi packetstormsecurity.com
Mar 5, 2015SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_CVE-2015-2216 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter.
Product
Photocrati
Affected
up to 4.07
What to do
Affects up to 4.07. Update Photocrati to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Mar 3, 2015The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain adCVE-2015-0890 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
Product
BestWebSoft Google Captcha (aka reCAPTCHA)
Fixed in
1.13
What to do
Update BestWebSoft Google Captcha (aka reCAPTCHA) to 1.13 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 3, 2015The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access viCVE-2014-9283 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
Product
BestWebSoft Captcha
Fixed in
4.0.7
What to do
Update BestWebSoft Captcha to 4.0.7 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Feb 17, 2015FancyBox for: For WordPress does not properly restrict accessCVE-2015-1494 · WordPress plugins & themes · reported by Red HatMedium 4.3
The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015.
Product
FancyBox for
Fixed in
3.0.3
What to do
Update FancyBox for to 3.0.3 or newer.
Full record and what to do →NVD record blog.sucuri.net osvdb.org
Jan 28, 2015pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attaCVE-2015-1375 · WordPress plugins & themes · reported by MITREHigh 7.5
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.
Product
pixabay-images.php in the Pixabay Images
Fixed in
2.4
What to do
Update pixabay-images.php in the Pixabay Images to 2.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 23, 2015The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers toCVE-2014-8802 · WordPress plugins & themes · reported by MITREMedium 5
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.
Product
Pie Register
Fixed in
2.0.14
What to do
Update Pie Register to 2.0.14 or newer.
Full record and what to do →NVD record secunia.com security.szurek.pl
Dec 24, 2014The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgerCVE-2014-9414 · WordPress plugins & themes · reported by MITREMedium 6.8
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the mobile_groups[*][redirect] parameter and an empty _wpnonce parameter in the w3tc_mobile page to wp-admin/admin.php.
Product
W3 Total Cache
Fixed in
0.9.4.1
What to do
Update W3 Total Cache to 0.9.4.1 or newer.
Full record and what to do →NVD record mazinahmed1.blogspot.com packetstormsecurity.com
Dec 8, 2014SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote aCVE-2014-9305 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcode_products_table action to wp-admin/admin-ajax.php.
Product
SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite
Fixed in
1.5.2
What to do
Update SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite to 1.5.2 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Dec 5, 2014Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbounCVE-2014-9292 · WordPress plugins & themes · reported by MITREMedium 5.8
Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbound requests and enumerate open ports via the url parameter.
Product
jRSS Widget
Affected
up to 1.2
What to do
Affects up to 1.2. Update jRSS Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 2, 2014Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 aCVE-2014-9178 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 1, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Server-side request forgery (SSRF)CVE-2014-8749 · WordPress plugins & themes · reported by MITREMedium 5
Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
Affected
up to .51
What to do
Affects up to .51. Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wordpress.org
Nov 28, 2014Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitraCVE-2014-8801 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.
Product
Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro
Fixed in
1.7.15
What to do
Update Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro to 1.7.15 or newer.
Full record and what to do →NVD record packetstormsecurity.com security.szurek.pl
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: SQL injectionCVE-2014-7959 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
What to do
Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Cross-site scripting (XSS)CVE-2014-7958 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
What to do
Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 3, 2014Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 CVE-2014-7228 · WordPress plugins & themes · reported by MITREHigh 7.5
Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.
Affected
up to 2.5.25
What to do
Affects up to 2.5.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.joomla.org websec.wordpress.com
Sep 26, 2014The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary fiCVE-2014-6446 · WordPress plugins & themes · reported by MITREHigh 7.5
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Product
Infusionsoft Gravity Forms plugin 1.5.3
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update Infusionsoft Gravity Forms plugin 1.5.3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Aug 29, 2014The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtaCVE-2014-5337 · WordPress plugins & themes · reported by MITREMedium 5
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.
Product
WordPress Mobile Pack
Fixed in
2.0.2
What to do
Update WordPress Mobile Pack to 2.0.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 12, 2014Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5CVE-2014-5196 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.
Fixed in
1.2.5
What to do
Update the plugin to 1.2.5 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 6, 2014Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attackers to read arbitraCVE-2014-5181 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the snode parameter.
Product
Last.fm Rotation (lastfm-rotation)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Last.fm Rotation (lastfm-rotation) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earlier for WordPress alCVE-2014-4541 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
Product
OMFG Mobile Pro
Affected
up to 1.1.26
What to do
Affects up to 1.1.26. Update OMFG Mobile Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in pq_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote attackers to inject arbCVE-2014-4545 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in pq_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) leftorright or (2) author parameter.
Product
Pro Quoter
Affected
up to 1.0
What to do
Affects up to 1.0. Update Pro Quoter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com securityfocus.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary wCVE-2014-4538 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Product
Malware Finder
Affected
up to 1.1
What to do
Affects up to 1.1. Update Malware Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 CVE-2014-4528 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) promo_type, (2) fb_edit_action, or (3) promo_id parameter.
Product
Bugs Go Viral : Facebook Promotion Generator (fbpromotions)
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Bugs Go Viral : Facebook Promotion Generator (fbpromotions) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jun 11, 2014Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of adminCVE-2014-3850 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to wp-admin/options-general.php.
Product
Member Approval
Affected
131109 to 131109
What to do
Affects 131109 to 131109. Update Member Approval to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org security.dxw.com
May 23, 2014The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a reqCVE-2014-3849 · WordPress plugins & themes · reported by MITREMedium 4.3
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter.
Product
iMember360 plugin 3.8.012
Affected
up to 3.9.001
What to do
Affects up to 3.9.001. Update iMember360 plugin 3.8.012 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
May 23, 2014The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dCVE-2014-3848 · WordPress plugins & themes · reported by MITREMedium 5
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dbinfo parameter.
Product
iMember360
Fixed in
3.9.001
What to do
Update iMember360 to 3.9.001 or newer.
Full record and what to do →NVD record packetstormsecurity.com releases.imember360.com
May 22, 2014The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecCVE-2014-3844 · WordPress plugins & themes · reported by MITREMedium 5
The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information.
Product
TinyMCE Color Picker
Fixed in
1.2
What to do
Update TinyMCE Color Picker to 1.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 13, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remCVE-2013-1407 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro
Fixed in
5.3.5
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro to 5.3.5 or newer.
Full record and what to do →NVD record archives.neohapsis.com wp-events-plugin.com
May 6, 2014The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \'CVE-2014-2558 · WordPress plugins & themes · reported by MITREMedium 6.5
The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.
Product
File Gallery
Fixed in
1.7.9.2
What to do
Update File Gallery to 1.7.9.2 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Apr 9, 2014The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of aCVE-2014-0166 · WordPress plugins & themes · reported by Red HatMedium 6.4
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.
Fixed in
3.7.2
What to do
Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD record codex.wordpress.org codex.wordpress.org
Mar 14, 2014Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcfCVE-2014-2265 · WordPress plugins & themes · reported by MITREMedium 5
Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter.
Fixed in
3.7.2
What to do
Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD record contactform7.com web.archive.org
Mar 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inCVE-2013-3487 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified HTML header fields to (1) 400.php, (2) 403.php, or (3) 403.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record osvdb.org osvdb.org
Feb 27, 2014SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress alCVE-2014-1854 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record secunia.com adrotateplugin.com
Jan 20, 2014wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated userCVE-2012-6635 · WordPress plugins & themes · reported by MITREMedium 4
wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft.
Fixed in
3.3.3
What to do
Update the plugin to 3.3.3 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jan 20, 2014wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass CVE-2010-5293 · WordPress plugins & themes · reported by MITREMedium 5.8
wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam restrictions via a crafted URL, as demonstrated by a URL that triggers a substring match.
Fixed in
3.0.2
What to do
Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Nov 5, 2013The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaCVE-2013-3264 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.4
The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaign.php, which allows remote attackers to modify list or campaign data.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Nov 1, 2013Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack tCVE-2013-5977 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.
Product
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite
Fixed in
1.5.1.15
What to do
Update Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite to 1.5.1.15 or newer.
Full record and what to do →NVD record archives.neohapsis.com blog.noobroot.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.