Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,208 results · page 24 of 25

Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple RCVE-2020-35935 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)
Product
Advanced Access Manager
Fixed in
6.6.2
What to do
Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Jun 12, 2020In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintendCVE-2020-4048 · WordPress plugins & themes · reported by GitHubMedium 5.7
In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Apr 19, 2020In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gCVE-2020-11928 · WordPress plugins & themes · reported by MITRECritical 9.8
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.
Product
In the media-library-assistant
Fixed in
2.82
What to do
Update In the media-library-assistant to 2.82 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 7, 2020Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScrCVE-2020-11516 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
Product
Stored XSS in the Contact Form 7 Datepicker
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Stored XSS in the Contact Form 7 Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escCVE-2020-11514 · WordPress plugins & themes · reported by MITRECritical 9.8
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
Product
Rank Math
Affected
up to 1.0.40.2
What to do
Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record rankmath.com wordpress.org
Oct 10, 2019The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.CVE-2015-9477 · WordPress plugins & themes · reported by MITREHigh 8.8
The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.
Affected
1.2.8 to 1.2.8
What to do
Affects 1.2.8 to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Oct 10, 2019The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates.CVE-2015-9476 · WordPress plugins & themes · reported by MITREHigh 8.8
The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates.
Affected
1.8.1 to 1.8.1
What to do
Affects 1.8.1 to 1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Oct 10, 2019The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.CVE-2015-9475 · WordPress plugins & themes · reported by MITREHigh 8.8
The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Oct 10, 2019The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.CVE-2015-9474 · WordPress plugins & themes · reported by MITREHigh 8.8
The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.
Affected
1.3.2 to 1.3.2
What to do
Affects 1.3.2 to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 26, 2019The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.CVE-2015-9444 · WordPress plugins & themes · reported by MITREMedium 6.1
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
Affected
1.3.0 to 1.3.0
What to do
Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.CVE-2016-11011 · WordPress plugins & themes · reported by MITREMedium 6.5
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.CVE-2016-11010 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.CVE-2016-11009 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.CVE-2016-11008 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 16, 2019The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.CVE-2016-10972 · WordPress plugins & themes · reported by MITRECritical 9.8
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
Product
newspaper
Fixed in
6.7.2
What to do
Update newspaper to 6.7.2 or newer.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Sep 11, 2019In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provideCVE-2019-16220 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org github.com
Sep 3, 2019The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] paramCVE-2019-15889 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
Product
download-manager
Fixed in
2.9.94
What to do
Update download-manager to 2.9.94 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.CVE-2019-15871 · WordPress plugins & themes · reported by MITREMedium 4.3
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Aug 29, 2019The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.CVE-2019-15769 · WordPress plugins & themes · reported by MITREHigh 8.8
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
Product
handl-utm-grabber
Fixed in
2.6.5
What to do
Update handl-utm-grabber to 2.6.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme upCVE-2019-15650 · WordPress plugins & themes · reported by MITREMedium 4.3
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
Product
stops-core-theme-and-plugin-updates
Fixed in
8.0.5
What to do
Update stops-core-theme-and-plugin-updates to 8.0.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.CVE-2017-18584 · WordPress plugins & themes · reported by MITREHigh 7.5
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
Product
post-pay-counter
Fixed in
2.731
What to do
Update post-pay-counter to 2.731 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The updater plugin before 1.35 for WordPress has multiple XSS issues.CVE-2017-18565 · WordPress plugins & themes · reported by MITREMedium 6.1
The updater plugin before 1.35 for WordPress has multiple XSS issues.
Product
updater
Fixed in
1.35
What to do
Update updater to 1.35 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.CVE-2017-18520 · WordPress plugins & themes · reported by MITREMedium 6.1
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
Product
democracy-poll
Fixed in
5.4
What to do
Update democracy-poll to 5.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.CVE-2018-20973 · WordPress plugins & themes · reported by MITRECritical 9.8
The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.CVE-2018-20972 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked CVE-2019-14795 · WordPress plugins & themes · reported by MITREMedium 4.8
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jun 19, 2019An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress.CVE-2018-16613 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction.
Product
An issue was discovered in the update function in the wpForo Forum
Fixed in
1.5.2
What to do
Update An issue was discovered in the update function in the wpForo Forum to 1.5.2 or newer.
Full record and what to do →NVD record github.com github.com
May 13, 2019The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstratCVE-2019-11886 · WordPress plugins & themes · reported by MITREHigh 8.8
The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.
Product
WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer)
Fixed in
7.2.1
What to do
Update WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) to 7.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
May 6, 2019The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_defaulCVE-2019-11807 · WordPress plugins & themes · reported by MITREHigh 7.5
The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_default_keys_load parameter because of a nopriv_ registration and a lack of capabilities checks.
Product
WooCommerce Checkout Manager
Fixed in
4.3
What to do
Update WooCommerce Checkout Manager to 4.3 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Oct 3, 2018The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.CVE-2018-17946 · WordPress plugins & themes · reported by MITREMedium 6.1
The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.
Product
Tribulant Slideshow Gallery
Fixed in
1.6.6.1
What to do
Update Tribulant Slideshow Gallery to 1.6.6.1 or newer.
Full record and what to do →NVD record defensecode.com wordpress.org
Jul 13, 2018The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, CVE-2016-6565 · WordPress plugins & themes · reported by cret@cert.orgHigh 7.5
The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).
Fixed in
2.1.57
What to do
Update the plugin to 2.1.57 or newer.
Full record and what to do →NVD record kb.cert.org securityfocus.com
Apr 16, 2018Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.CVE-2018-10100 · WordPress plugins & themes · reported by MITREMedium 6.1
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securitytracker.com codex.wordpress.org
Dec 27, 2017Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.CVE-2015-7666 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.
Fixed in
1.0.2
What to do
Update the plugin to 1.0.2 or newer.
Full record and what to do →NVD record securityfocus.com plugins.trac.wordpress.org
Oct 24, 2017Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.CVE-2017-15863 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.
Product
Cross Site Scripting (XSS) exists in the wp-noexternallinks
Fixed in
3.5.19
What to do
Update Cross Site Scripting (XSS) exists in the wp-noexternallinks to 3.5.19 or newer.
Full record and what to do →NVD record lists.openwall.net wordpress.org
Oct 6, 2017The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WorCVE-2015-2673 · WordPress plugins & themes · reported by MITREHigh 8.8
The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain administrator privileges and execute arbitrary code via the option_name and option_value parameters.
Affected
up to 3.0.20
What to do
Affects up to 3.0.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.rastating.com blog.rastating.com
Sep 26, 2017Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute aCVE-2015-7670 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) id parameter.
Product
Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System
Fixed in
1.2.1
What to do
Update Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System to 1.2.1 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL inCVE-2017-1002010 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.
Affected
1.58 to 1.58
What to do
Affects 1.58 to 1.58. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record membership.officeautopilot.com vapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL inCVE-2017-1002009 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.
Affected
1.58 to 1.58
What to do
Affects 1.58 to 1.58. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record membership.officeautopilot.com vapidlabs.com
Aug 7, 2017The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.CVE-2014-9260 · WordPress plugins & themes · reported by MITREHigh 8.8
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
Product
basic_settings function in the download manager
Fixed in
2.7.3
What to do
Update basic_settings function in the download manager to 2.7.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 2, 2017The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-iCVE-2017-12199 · WordPress plugins & themes · reported by MITRECritical 9.8
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-item, tag_group_update_order list_item, category_products_update_order category-product-item, custom_fields_update_order field-item, categories_update_order category-item, subcategories_update_order subcategory-item, and tags_update_order tag-list-item.
Affected
4.2.11 to 4.2.11
What to do
Affects 4.2.11 to 4.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 21, 2017The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which aCVE-2015-3421 · WordPress plugins & themes · reported by MITREMedium 6.1
The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.
Affected
up to 6.3.11
What to do
Affects up to 6.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com htbridge.com
Jan 18, 2017the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6: Cross-site request forgery (CSRF)CVE-2016-6897 · WordPress plugins & themes · reported by MITREMedium 6.5
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
Product
the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6
Fixed in
4.6
What to do
Update the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 to 4.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 18, 2017the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3: Directory traversalCVE-2016-6896 · WordPress plugins & themes · reported by MITREHigh 7.1
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.
Product
the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3
What to do
Update the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 to the newest version.
Full record and what to do →NVD record openwall.com securitytracker.com
Jan 18, 2017The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_pluginsCVE-2016-10148 · WordPress plugins & themes · reported by MITREMedium 4.3
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.
Fixed in
4.6
What to do
Update the plugin to 4.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 14, 2017Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script CVE-2017-5488 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Oct 6, 2016Remote file download vulnerability in candidate-application-form v1.0 wordpress pluginCVE-2015-1000005 · WordPress plugins & themes · reported by MITREHigh 7.5
Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
May 21, 2016The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attackCVE-2016-2222 · WordPress plugins & themes · reported by security@debian.orgHigh 8.6
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
Fixed in
4.4.2
What to do
Update the plugin to 4.4.2 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 21, 2016the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2: Open redirectCVE-2016-2221 · WordPress plugins & themes · reported by security@debian.orgHigh 7.4
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
Product
the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2
Fixed in
4.4.2
What to do
Update the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 to 4.4.2 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 3, 2015The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings actionCVE-2015-4038 · WordPress plugins & themes · reported by MITREMedium 6.5
The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings action to wp-admin/admin-ajax.php.
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jan 28, 2015pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrCVE-2015-1376 · WordPress plugins & themes · reported by MITREMedium 4
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
Product
pixabay-images.php in the Pixabay Images
Fixed in
2.4
What to do
Update pixabay-images.php in the Pixabay Images to 2.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.