Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,117 results · page 23 of 23
Sep 6, 2018thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600: WordPress version 4.9.8 and earlier contains a CWE-20 Input ValidationCVE-2018-1000773 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time.
- Product
- thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600
- Affected
- up to 4.9.8
- What to do
- Affects up to 4.9.8. Update thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comtheregister.co.uk
Sep 6, 2018thumbnail processing that can result in remote code execution: WordPress version <4.9 contains a CWE-20 Input ValidationCVE-2017-1000600 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9
- Product
- thumbnail processing that can result in remote code execution
- What to do
- Update thumbnail processing that can result in remote code execution to the newest version.
Full record and what to do →NVD recordsecurityfocus.comtheregister.co.uk
Jul 13, 2018The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, CVE-2016-6565 · WordPress plugins & themes · reported by cret@cert.orgHigh 7.5
The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).
- Fixed in
- 2.1.57
- What to do
- Update the plugin to 2.1.57 or newer.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
Apr 16, 2018Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.CVE-2018-10101 · WordPress plugins & themes · reported by MITREMedium 6.1
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Apr 16, 2018Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.CVE-2018-10100 · WordPress plugins & themes · reported by MITREMedium 6.1
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecuritytracker.comcodex.wordpress.org
Jul 21, 2017The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which aCVE-2015-3421 · WordPress plugins & themes · reported by MITREMedium 6.1
The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.
- Affected
- up to 6.3.11
- What to do
- Affects up to 6.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comhtbridge.com
May 18, 2017In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.CVE-2017-9066 · WordPress plugins & themes · reported by MITREHigh 8.6
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
- Fixed in
- 4.7.5
- What to do
- Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Mar 11, 2017In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.CVE-2017-6815 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
- Fixed in
- 4.7.3
- What to do
- Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Oct 6, 2016Remote file download vulnerability in candidate-application-form v1.0 wordpress pluginCVE-2015-1000005 · WordPress plugins & themes · reported by MITREHigh 7.5
Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
May 21, 2016The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attackCVE-2016-2222 · WordPress plugins & themes · reported by security@debian.orgHigh 8.6
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
- Fixed in
- 4.4.2
- What to do
- Update the plugin to 4.4.2 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
May 21, 2016the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2: Open redirectCVE-2016-2221 · WordPress plugins & themes · reported by security@debian.orgHigh 7.4
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
- Product
- the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2
- Fixed in
- 4.4.2
- What to do
- Update the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 to 4.4.2 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Jan 28, 2015pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrCVE-2015-1376 · WordPress plugins & themes · reported by MITREMedium 4
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
- Product
- pixabay-images.php in the Pixabay Images
- Fixed in
- 2.4
- What to do
- Update pixabay-images.php in the Pixabay Images to 2.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 1, 2014Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web scCVE-2014-4564 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter.
- Product
- Validated
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Validated to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Apr 9, 2014The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of aCVE-2014-0166 · WordPress plugins & themes · reported by Red HatMedium 6.4
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.
- Fixed in
- 3.7.2
- What to do
- Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcodex.wordpress.org
Sep 12, 2013WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictionsCVE-2013-4339 · WordPress plugins & themes · reported by Red HatHigh 7.5
WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.
- Fixed in
- 3.6.1
- What to do
- Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Dec 27, 2012WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discoverCVE-2012-5868 · WordPress plugins & themes · reported by MITRELow 2.6
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwhiteoaksecurity.comwhiteoaksecurity.com
Dec 19, 2008wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remoteCVE-2008-5695 · WordPress plugins & themes · reported by MITREHigh 8.5
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.
- Affected
- up to 2.3.2
- Fixed in
- 1.3.2
- What to do
- Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD recordmu.wordpress.orgsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.