Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,507 results · page 27 of 31

Oct 10, 2019The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_portfolio_item_page SQL injection via the item_id parameter.CVE-2015-9461 · WordPress plugins & themes · reported by MITREHigh 7.2
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_portfolio_item_page SQL injection via the item_id parameter.
Product
awesome-filterable-portfolio
Fixed in
1.9
What to do
Update awesome-filterable-portfolio to 1.9 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 10, 2019The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.CVE-2015-9460 · WordPress plugins & themes · reported by MITREHigh 8.8
The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.
Product
booking-system
Fixed in
2.1
What to do
Update booking-system to 2.1 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 10, 2019The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.CVE-2015-9459 · WordPress plugins & themes · reported by MITREMedium 6.1
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
Product
searchterms-tagging-2
Affected
up to 1.535
What to do
Affects up to 1.535. Update searchterms-tagging-2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 10, 2019The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF.CVE-2015-9458 · WordPress plugins & themes · reported by MITREHigh 7.2
The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF.
Product
searchterms-tagging-2
Affected
up to 1.535
What to do
Affects up to 1.535. Update searchterms-tagging-2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 10, 2019The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.CVE-2015-9457 · WordPress plugins & themes · reported by MITREHigh 7.2
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.
Product
pretty-link
Fixed in
1.6.8
What to do
Update pretty-link to 1.6.8 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parametCVE-2015-9455 · WordPress plugins & themes · reported by MITREHigh 8.1
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
Product
buddypress-activity-plus
Fixed in
1.6.2
What to do
Update buddypress-activity-plus to 1.6.2 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Oct 7, 2019The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.CVE-2015-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
Product
smooth-slider
Fixed in
2.7
What to do
Update smooth-slider to 2.7 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.CVE-2015-9452 · WordPress plugins & themes · reported by MITRECritical 9.8
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
Product
nex-forms-express-wp-form-builder
Fixed in
4.6.1
What to do
Update nex-forms-express-wp-form-builder to 4.6.1 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameCVE-2015-9451 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.CVE-2015-9450 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 26, 2019The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.CVE-2015-9448 · WordPress plugins & themes · reported by MITREHigh 8.8
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.
Product
sendpress
Fixed in
1.2
What to do
Update sendpress to 1.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.CVE-2015-9447 · WordPress plugins & themes · reported by MITREMedium 6.5
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.CVE-2015-9439 · WordPress plugins & themes · reported by MITREMedium 4.8
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
Product
addthis
Fixed in
5.0.13
What to do
Update addthis to 5.0.13 or newer.
Full record and what to do →NVD record blog.cinu.pl wordpress.org
Sep 25, 2019The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameterCVE-2015-9438 · WordPress plugins & themes · reported by MITREMedium 5.4
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Product
display-widgets
Fixed in
2.04
What to do
Update display-widgets to 2.04 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.CVE-2015-9437 · WordPress plugins & themes · reported by MITREMedium 6.5
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Product
dynamic-widgets
Fixed in
1.5.11
What to do
Update dynamic-widgets to 1.5.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.CVE-2015-9436 · WordPress plugins & themes · reported by MITREMedium 5.4
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.
Product
dynamic-widgets
Fixed in
1.5.11
What to do
Update dynamic-widgets to 1.5.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc.CVE-2015-9433 · WordPress plugins & themes · reported by MITREMedium 6.5
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php.
Product
wp-social-bookmarking-light
Fixed in
1.7.10
What to do
Update wp-social-bookmarking-light to 1.7.10 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.CVE-2015-9449 · WordPress plugins & themes · reported by MITREHigh 7.2
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Product
microblog-poster
Fixed in
1.6.2
What to do
Update microblog-poster to 1.6.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameCVE-2015-9429 · WordPress plugins & themes · reported by MITREMedium 6.5
The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
Product
yith-maintenance-mode
Fixed in
1.2.0
What to do
Update yith-maintenance-mode to 1.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.CVE-2015-9427 · WordPress plugins & themes · reported by MITREMedium 6.5
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
Product
googmonify
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update googmonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.CVE-2015-9426 · WordPress plugins & themes · reported by MITREMedium 4.6
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
Product
manual-image-crop
Fixed in
1.11
What to do
Update manual-image-crop to 1.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.CVE-2015-9421 · WordPress plugins & themes · reported by MITREMedium 6.5
The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
Product
olevmedia-shortcodes
Fixed in
1.1.9
What to do
Update olevmedia-shortcodes to 1.1.9 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.CVE-2015-9420 · WordPress plugins & themes · reported by MITREMedium 6.1
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
Product
soundcloud-is-gold
Fixed in
2.3.2
What to do
Update soundcloud-is-gold to 2.3.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.CVE-2015-9414 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
Product
wp-symposium
Affected
up to 15.8.1
What to do
Affects up to 15.8.1. Update wp-symposium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.CVE-2015-9413 · WordPress plugins & themes · reported by MITREMedium 6.5
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Product
eshop
Affected
up to 6.3.13
What to do
Affects up to 6.3.13. Update eshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.CVE-2015-9412 · WordPress plugins & themes · reported by MITREMedium 6.1
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.
Product
Royal-Slider
Fixed in
3.2.7
What to do
Update Royal-Slider to 3.2.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.CVE-2015-9410 · WordPress plugins & themes · reported by MITREMedium 5.4
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.
Affected
6.0.4 to 6.0.4
What to do
Affects 6.0.4 to 6.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com github.com
Sep 20, 2019The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.CVE-2014-10397 · WordPress plugins & themes · reported by MITREHigh 7.5
The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.
Product
Antioch
Affected
up to 2014-09-07
What to do
Affects up to 2014-09-07. Update Antioch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 20, 2019The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.CVE-2014-10396 · WordPress plugins & themes · reported by MITREHigh 7.5
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.
Product
epic
Affected
up to 2014-09-07
What to do
Affects up to 2014-09-07. Update epic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.CVE-2015-9393 · WordPress plugins & themes · reported by MITREMedium 5.4
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.CVE-2015-9392 · WordPress plugins & themes · reported by MITREMedium 5.4
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.CVE-2016-11000 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.
Product
wp-ultimate-exporter
Affected
up to 1.1
What to do
Affects up to 1.1. Update wp-ultimate-exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 20, 2019The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.CVE-2016-10999 · WordPress plugins & themes · reported by MITREMedium 6.1
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
Product
Goodnews
Affected
up to 2016-02-28
What to do
Affects up to 2016-02-28. Update Goodnews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Sep 20, 2019The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.CVE-2015-9391 · WordPress plugins & themes · reported by MITREMedium 6.1
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.
Product
yawpp
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update yawpp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.CVE-2015-9386 · WordPress plugins & themes · reported by MITREMedium 6.1
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
Product
mtouch-quiz
Fixed in
3.1.3
What to do
Update mtouch-quiz to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org davidsopas.com
Sep 18, 2019The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.CVE-2016-10994 · WordPress plugins & themes · reported by MITREMedium 6.1
The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
Affected
2016_q2 to 2016_q2
What to do
Affects 2016_q2 to 2016_q2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com vulnerability-lab.com
Sep 17, 2019The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.CVE-2016-10993 · WordPress plugins & themes · reported by MITREMedium 5.4
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
Product
ScoreMe
Affected
up to 2016-04-01
What to do
Affects up to 2016-04-01. Update ScoreMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com vulnerability-lab.com
Sep 17, 2019The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.CVE-2016-10992 · WordPress plugins & themes · reported by MITREMedium 6.1
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
Product
music-store
Fixed in
1.0.43
What to do
Update music-store to 1.0.43 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 17, 2019The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.CVE-2016-10985 · WordPress plugins & themes · reported by MITREMedium 6.1
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
Product
echosign
Fixed in
1.2
What to do
Update echosign to 1.2 or newer.
Full record and what to do →NVD record 0x62626262.wordpress.com wordpress.org
Sep 17, 2019The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.CVE-2016-10984 · WordPress plugins & themes · reported by MITREMedium 6.1
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
Product
echosign
Fixed in
1.2
What to do
Update echosign to 1.2 or newer.
Full record and what to do →NVD record 0x62626262.wordpress.com wordpress.org
Sep 17, 2019The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.CVE-2016-10975 · WordPress plugins & themes · reported by MITREMedium 6.1
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
Product
fluid-responsive-slideshow
Fixed in
2.2.7
What to do
Update fluid-responsive-slideshow to 2.2.7 or newer.
Full record and what to do →NVD record klikki.fi wordpress.org
Sep 16, 2019The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.CVE-2016-10973 · WordPress plugins & themes · reported by MITREMedium 6.1
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.
Product
Brafton
Fixed in
3.4.8
What to do
Update Brafton to 3.4.8 or newer.
Full record and what to do →NVD record wpvulndb.com openwall.com
Sep 16, 2019The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.CVE-2016-10967 · WordPress plugins & themes · reported by MITREMedium 6.1
The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mukarramkhalid.com wordpress.org
Sep 16, 2019The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.CVE-2016-10962 · WordPress plugins & themes · reported by MITREMedium 6.5
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.
Product
icegram
Fixed in
1.9.19
What to do
Update icegram to 1.9.19 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 16, 2019The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.CVE-2016-10961 · WordPress plugins & themes · reported by MITREMedium 6.1
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.
Product
colorway
Fixed in
3.4.2
What to do
Update colorway to 3.4.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wpvulndb.com
Sep 16, 2019The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.CVE-2016-10960 · WordPress plugins & themes · reported by MITREHigh 8.8
The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.
Product
wsecure
Fixed in
2.4
What to do
Update wsecure to 2.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Sep 16, 2019The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.CVE-2016-10957 · WordPress plugins & themes · reported by MITREMedium 6.1
The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
Product
Akal
Affected
up to 2016-08-22
What to do
Affects up to 2016-08-22. Update Akal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com saotn.org
Sep 15, 2019In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possiCVE-2019-16332 · WordPress plugins & themes · reported by MITREMedium 6.1
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
Product
api-bearer-auth
Fixed in
20190907
What to do
Update api-bearer-auth to 20190907 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 13, 2019The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.CVE-2019-16289 · WordPress plugins & themes · reported by MITREMedium 5.4
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
Product
insert-php (aka Woody ad snippets)
Fixed in
2.2.8
What to do
Update insert-php (aka Woody ad snippets) to 2.2.8 or newer.
Full record and what to do →NVD record generaleg0x01.com wordpress.org
Sep 13, 2019The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.CVE-2016-10952 · WordPress plugins & themes · reported by MITREMedium 6.1
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.
Product
quotes-collection
Fixed in
2.0.6
What to do
Update quotes-collection to 2.0.6 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.