Updated 12 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

517new WordPress flaws this week

397,455entries in the database

12,578 results · page 249 of 252

Oct 3, 2013Cross-site scripting (XSS) vulnerability in the Comment Attachment plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2013-6010 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Comment Attachment plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Attachment field title."
Product
Comment Attachment
What to do
Update Comment Attachment to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Sep 26, 2013Cross-site scripting (XSS) vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via tCVE-2013-4626 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php.
Product
Cross-site scripting (XSS) vulnerability in the BackWPup
Fixed in
3.0.13
What to do
Update Cross-site scripting (XSS) vulnerability in the BackWPup to 3.0.13 or newer.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Sep 23, 2013Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attackers to inject arbitrCVE-2013-5918 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO
Fixed in
1.3.8
What to do
Update Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO to 1.3.8 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Sep 17, 2013Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackCVE-2013-5711 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System
Fixed in
3.7
What to do
Update Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System to 3.7 or newer.
Full record and what to do →NVD record archives.neohapsis.com wordpress.org
Sep 9, 2013Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WorCVE-2013-5714 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) message parameter. NOTE: some of these details are obtained from third party information.
Product
VideoWhisper Live Streaming Integration
What to do
Update VideoWhisper Live Streaming Integration to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-5098 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Aug 9, 2013Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arCVE-2013-4625 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.
Product
Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator
Fixed in
0.4.5
What to do
Update Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator to 0.4.5 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-3262 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor
Fixed in
3.3.6.2
What to do
Update Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor to 3.3.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jul 29, 2013Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New RegCVE-2013-4954 · WordPress plugins & themes · reported by MITRELow 2.6
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.
Product
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register
Fixed in
1.31
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register to 1.31 or newer.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Jul 29, 2013Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" componenCVE-2013-4944 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" component is enabled, allows remote attackers to inject arbitrary web script or HTML via the friendship_request_message parameter to wp-admin/admin-ajax.php. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request
Fixed in
1.0.2
What to do
Update Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request to 1.0.2 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Jul 19, 2013Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and otCVE-2012-3414 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.
Affected
up to 2.2.0.1
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record bot24.blogspot.ca code.google.com
Jul 16, 2013Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to injCVE-2013-4117 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
Product
Category Grid View Gallery
What to do
Update Category Grid View Gallery to the newest version.
Full record and what to do →NVD record exploit.iedb.ir openwall.com
Jul 8, 2013Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involvinCVE-2013-2201 · WordPress plugins & themes · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record codex.wordpress.org wordpress.org
Jul 8, 2013Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products,: Cross-site scripting (XSS)CVE-2013-0237 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Product
Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products,
Fixed in
1.5.5
What to do
Update Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, to 1.5.5 or newer.
Full record and what to do →NVD record codex.wordpress.org wordpress.org
Jul 8, 2013Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involvinCVE-2013-0236 · WordPress plugins & themes · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.
Fixed in
3.5.1
What to do
Update the plugin to 3.5.1 or newer.
Full record and what to do →NVD record codex.wordpress.org core.trac.wordpress.org
Jun 1, 2013Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrCVE-2013-3261 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action.
Product
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery
Fixed in
2.72
What to do
Update Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery to 2.72 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 31, 2013Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb plugin before 1.9 for WordPress allows remote authenticated administrators to injecCVE-2013-3720 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb plugin before 1.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wp_post_id parameter.
Product
Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb
Fixed in
1.9
What to do
Update Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb to 1.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
May 10, 2013Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for WordPress allow remote attackers to inject CVE-2013-3529 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message, (2) photo-message, or (3) youtube-message parameter.
Product
Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress
Fixed in
1.1.7
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress to 1.1.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
May 10, 2013js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for: Cross-site scripting (XSS)CVE-2013-3526 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter.
Product
js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
May 10, 2013Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arCVE-2013-3254 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppa_manage_comments edit action.
Product
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus
Fixed in
5.0.3
What to do
Update Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus to 5.0.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 22, 2013Cross-site scripting (XSS) vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2013-2501 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ProfileId field.
Product
Cross-site scripting (XSS) vulnerability in the Terillion Reviews
Fixed in
1.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Terillion Reviews to 1.2 or newer.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Feb 12, 2013Cross-site scripting (XSS) vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrCVE-2011-5265 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter. NOTE: this has been disputed by a third party.
Product
Featurific For
What to do
Update Featurific For to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Feb 12, 2013Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup plugin before 0.2.2 for WordPress allows remote attackers to inject arbitraCVE-2011-5264 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup plugin before 0.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xml_or_all parameter.
Product
Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup
Fixed in
0.2.2
What to do
Update Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup to 0.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Feb 12, 2013Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote attackers to inject arbitrary web script orCVE-2011-5257 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) twitter_id parameter related to the Twitter widget and (2) facebook_id parameter related to the Facebook widget.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Classipress
Fixed in
3.1.5
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Classipress to 3.1.5 or newer.
Full record and what to do →NVD record docs.appthemes.com secunia.com
Feb 7, 2013Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrarCVE-2013-1464 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter.
Product
Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player
Fixed in
2.0.4.6
What to do
Update Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player to 2.0.4.6 or newer.
Full record and what to do →NVD record insight-labs.org packetstormsecurity.com
Feb 7, 2013Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allows remote attackers tCVE-2013-1463 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be the same vulnerability as CVE-2013-1808. If so, it is likely that CVE-2013-1463 will be REJECTed.
Product
Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module
Fixed in
1.9.4
What to do
Update Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module to 1.9.4 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 31, 2013Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML viCVE-2012-6527 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Product
Cross-site scripting (XSS) vulnerability in the My Calendar
Fixed in
1.10.2
What to do
Update Cross-site scripting (XSS) vulnerability in the My Calendar to 1.10.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jan 23, 2013Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbCVE-2012-6511 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) delete_id parameter or (2) extension parameter in an "Update Setting" action to wp-admin/admin.php.
Product
Organizer
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org websecurity.com.ua
Jan 23, 2013Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or CVE-2012-6506 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.
Product
Zingiri Web Shop
What to do
Update Zingiri Web Shop to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jan 23, 2013Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitraCVE-2011-4618 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Product
Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget
Fixed in
2.0.2
What to do
Update Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget to 2.0.2 or newer.
Full record and what to do →NVD record archives.neohapsis.com plugins.trac.wordpress.org
Dec 19, 2012Cross-site scripting (XSS) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unsCVE-2012-5177 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Welcart
Fixed in
1.2.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Welcart to 1.2.2 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Dec 11, 2012the Video Lead Form plugin for: Cross-site scripting (XSS)CVE-2012-6312 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php.
Product
the Video Lead Form plugin for
What to do
Update the Video Lead Form plugin for to the newest version.
Full record and what to do →NVD record archives.neohapsis.com wordpress.org
Nov 17, 2012wp-integrator.php in the WordPress Integrator module 1.32 for: Cross-site scripting (XSS)CVE-2012-5913 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.
Product
wp-integrator.php in the WordPress Integrator module 1.32 for
What to do
Update wp-integrator.php in the WordPress Integrator module 1.32 for to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Nov 17, 2012the Uk Cookie: Cross-site scripting (XSS)CVE-2012-5856 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Uk Cookie (aka uk-cookie) plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
the Uk Cookie
What to do
Update the Uk Cookie to the newest version.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
Oct 25, 2012Cross-site scripting (XSS) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to inject arbitrary web scCVE-2011-5225 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Product
Sentinel
What to do
Update Sentinel to the newest version.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Oct 24, 2012Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to injecCVE-2012-5388 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.
Product
White Label CMS
What to do
Update White Label CMS to the newest version.
Full record and what to do →NVD record packetstormsecurity.org wordpress.org
Oct 9, 2012Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or CVE-2012-5349 · WordPress plugins & themes · reported by MITRELow 2.6
Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) title, or (3) dl parameter.
Product
Pay-with-tweet
What to do
Update Pay-with-tweet to the newest version.
Full record and what to do →NVD record secunia.com wordpress.org
Oct 9, 2012wp-live.php in the WP Live.php module 1.2.1 for: Cross-site scripting (XSS)CVE-2012-5346 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter. NOTE: some of these details are obtained from third party information.
Product
wp-live.php in the WP Live.php module 1.2.1 for
What to do
Update wp-live.php in the WP Live.php module 1.2.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
Oct 8, 2012Multiple cross-site scripting (XSS) vulnerabilities in the scr_do_redirect function in scr.php in the Shortcode Redirect plugin 1.0.01 and earlier for WordPressCVE-2012-5325 · WordPress plugins & themes · reported by MITRELow 2.1
Multiple cross-site scripting (XSS) vulnerabilities in the scr_do_redirect function in scr.php in the Shortcode Redirect plugin 1.0.01 and earlier for WordPress allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (1) url or (2) sec attributes in a redirect tag.
Product
Shortcode Redirect
Affected
up to 1.0.01
What to do
Affects up to 1.0.01. Update Shortcode Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
Oct 8, 2012Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute CVE-2012-5318 · WordPress plugins & themes · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the directory specified by the folder parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1125.
Product
Kish Guest Posting
What to do
Update Kish Guest Posting to the newest version.
Full record and what to do →NVD record secunia.com openwall.com
Oct 8, 2012Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to eCVE-2012-1125 · WordPress plugins & themes · reported by Red HatMedium 6.8
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
Product
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting
Fixed in
1.2
What to do
Update Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting to 1.2 or newer.
Full record and what to do →NVD record archives.neohapsis.com plugins.svn.wordpress.org
Oct 4, 2012admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31: Cross-site scripting (XSS)CVE-2011-5207 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 allows remote attackers to inject arbitrary web script or HTML via the tcp_name_post_XXXXX parameter.
Product
admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31
Fixed in
1.1.6
What to do
Update admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 to 1.1.6 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Oct 1, 2012Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via thCVE-2012-4242 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page.
Product
MF Gig Calendar
What to do
Update MF Gig Calendar to the newest version.
Full record and what to do →NVD record reactionpenetrationtesting.co.uk securityfocus.com
Oct 1, 2012css/gallery-css.php in the Slideshow Gallery2 plugin for: Cross-site scripting (XSS)CVE-2012-5229 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the border parameter.
Product
css/gallery-css.php in the Slideshow Gallery2 plugin for
What to do
Update css/gallery-css.php in the Slideshow Gallery2 plugin for to the newest version.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers CVE-2011-5194 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter, a different vulnerability than CVE-2011-5193.
Product
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search
Fixed in
1.4.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search to 1.4.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.org plugins.trac.wordpress.org
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enablCVE-2011-5193 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than CVE-2011-5194.
Product
Whois Search
What to do
Update Whois Search to the newest version.
Full record and what to do →NVD record secunia.com secunia.com
Sep 23, 2012Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary webCVE-2011-5192 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5191.
Product
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite
Fixed in
1.5.6
What to do
Update Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite to 1.5.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Sep 23, 2012Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.4 for WordPress allows remote attackers to inject arbitrary webCVE-2011-5191 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5192.
Product
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite
Fixed in
1.5.4
What to do
Update Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite to 1.5.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 20, 2012Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitCVE-2011-5182 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input, and because that input is never sent to the browser, an attacker has no way of executing script or code on a user's behalf.
Product
Lanoba Social
What to do
Update Lanoba Social to the newest version.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Sep 20, 2012clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for: Cross-site scripting (XSS)CVE-2011-5181 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter. NOTE: some of these details are obtained from third party information.
Product
clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for
What to do
Update clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for to the newest version.
Full record and what to do →NVD record osvdb.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.