Updated 20 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

1,491 results · page 29 of 30

Aug 28, 2019The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.CVE-2015-9353 · WordPress plugins & themes · reported by MITREHigh 7.2
The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Product
gigpress
Fixed in
2.3.11
What to do
Update gigpress to 2.3.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.CVE-2012-6718 · WordPress plugins & themes · reported by MITREMedium 6.1
The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.
Product
sharebar
Fixed in
1.2.2
What to do
Update sharebar to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.CVE-2012-6717 · WordPress plugins & themes · reported by MITREMedium 6.1
The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.
Product
redirection
Fixed in
2.2.12
What to do
Update redirection to 2.2.12 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.CVE-2011-5329 · WordPress plugins & themes · reported by MITREMedium 6.1
The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.
Product
redirection
Fixed in
2.2.9
What to do
Update redirection to 2.2.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.CVE-2015-9351 · WordPress plugins & themes · reported by MITRECritical 9.8
The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
Product
feed-them-social
Fixed in
1.7.0
What to do
Update feed-them-social to 1.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.CVE-2015-9350 · WordPress plugins & themes · reported by MITREMedium 6.1
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
Product
feed-them-social
Fixed in
1.7.0
What to do
Update feed-them-social to 1.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.CVE-2019-15659 · WordPress plugins & themes · reported by MITRECritical 9.8
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
Product
pie-register
Fixed in
3.1.2
What to do
Update pie-register to 3.1.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 23, 2019The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name,CVE-2019-15092 · WordPress plugins & themes · reported by MITREHigh 7.3
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
Aug 22, 2019The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.CVE-2014-10382 · WordPress plugins & themes · reported by MITREMedium 4.3
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.
Product
feature-comments
Fixed in
1.2.5
What to do
Update feature-comments to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.CVE-2016-10930 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
Product
wp-support-plus-responsive-ticket-system
Fixed in
7.1.0
What to do
Update wp-support-plus-responsive-ticket-system to 7.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.CVE-2017-18571 · WordPress plugins & themes · reported by MITRECritical 9.8
The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.
Product
search-everything
Fixed in
8.1.7
What to do
Update search-everything to 8.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633CVE-2016-10919 · WordPress plugins & themes · reported by MITREMedium 6.1
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
Product
wassup
Fixed in
1.9.1
What to do
Update wassup to 1.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.CVE-2016-10917 · WordPress plugins & themes · reported by MITRECritical 9.8
The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
Product
search-everything
Fixed in
8.1.6
What to do
Update search-everything to 8.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.CVE-2016-10916 · WordPress plugins & themes · reported by MITRECritical 9.8
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
Product
appointment-booking-calendar
Fixed in
1.1.24
What to do
Update appointment-booking-calendar to 1.1.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.CVE-2012-6715 · WordPress plugins & themes · reported by MITREMedium 6.1
The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.
Product
formbuilder
Fixed in
0.9.1
What to do
Update formbuilder to 0.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.CVE-2017-18531 · WordPress plugins & themes · reported by MITREMedium 6.1
The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
Product
raygun4wp
Fixed in
1.8.3
What to do
Update raygun4wp to 1.8.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.CVE-2018-20971 · WordPress plugins & themes · reported by MITREHigh 8.8
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
Product
church-admin
Fixed in
1.2550
What to do
Update church-admin to 1.2550 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.CVE-2015-9309 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.CVE-2015-9308 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.CVE-2015-9307 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.CVE-2015-9314 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
Product
newstatpress
Fixed in
1.0.4
What to do
Update newstatpress to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.CVE-2015-9293 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.8
What to do
Update all-in-one-wp-security-and-firewall to 3.9.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.CVE-2018-20966 · WordPress plugins & themes · reported by MITREMedium 6.1
The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.
Product
woocommerce-jetpack
Fixed in
3.8.0
What to do
Update woocommerce-jetpack to 3.8.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 28, 2019The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.CVE-2019-14328 · WordPress plugins & themes · reported by MITREHigh 8.8
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
Product
Simple Membership
Fixed in
3.8.5
What to do
Update Simple Membership to 3.8.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Jul 23, 2019GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434.CVE-2019-1010209 · WordPress plugins & themes · reported by josh@bress.netHigh 7.5
GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L5637. The fixed version is: 1.4.14.
Affected
up to 1.4.13
What to do
Affects up to 1.4.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com github.com
Jul 23, 2019WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS).CVE-2019-1010124 · WordPress plugins & themes · reported by josh@bress.netMedium 5.4
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.
Affected
up to 2.2.18
What to do
Affects up to 2.2.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Jul 18, 2019TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection.CVE-2019-1010104 · WordPress plugins & themes · reported by josh@bress.netCritical 9.8
TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: like_escape is used in Quick-chat.php line 399. The attack vector is: Crafted ajax request.
Affected
up to 4.14
What to do
Affects up to 4.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record metalamin.github.io metalamin.github.io
Jul 15, 2019Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection.CVE-2019-1010034 · WordPress plugins & themes · reported by josh@bress.netMedium 6.5
Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection. This function call can be triggered by any user logged-in with at least Volunteer role or manage_circulation capabilities. PoC : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=DESC.
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpvulndb.com
Apr 25, 2019The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector.CVE-2019-9669 · WordPress plugins & themes · reported by MITREMedium 6.1
The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn't make a WordPress site vulnerable (speaking in terms of software vulnerabilities)
Product
Wordfence
Affected
7.2.3 to 7.2.3
What to do
Affects 7.2.3 to 7.2.3. Update Wordfence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record edgescan.com edgescan.com
Apr 23, 2019The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GETCVE-2019-10864 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
Product
WP Statistics
Affected
up to 12.6.2
What to do
Affects up to 12.6.2. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com medium.com
Jan 24, 2019The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrerCVE-2019-6780 · WordPress plugins & themes · reported by MITREMedium 6.1
The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer.
Product
Wise Chat
Fixed in
2.7
What to do
Update Wise Chat to 2.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Product
wp-slimstat (aka Slimstat Analytics)
Fixed in
4.1.6.1
What to do
Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 4, 2018The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.phCVE-2015-9271 · WordPress plugins & themes · reported by MITRECritical 9.8
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
Affected
4.91.8 to 4.91.8
What to do
Affects 4.91.8 to 4.91.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com vapidlabs.com
Oct 1, 2018The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitiCVE-2015-9269 · WordPress plugins & themes · reported by MITREHigh 7.5
The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format.
Product
export/content.php exportarticle feature in the wordpress-mobile-pack
Fixed in
2.1.3
What to do
Update export/content.php exportarticle feature in the wordpress-mobile-pack to 2.1.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Sep 15, 2018The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.CVE-2018-17074 · WordPress plugins & themes · reported by MITREMedium 6.1
The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.
Product
Feed Statistics
Fixed in
4.0
What to do
Update Feed Statistics to 4.0 or newer.
Full record and what to do →NVD record hackerone.com plugins.trac.wordpress.org
Aug 28, 2018Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2014-4932 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
Product
Cross-site scripting (XSS) vulnerability in the Wordfence Security
Fixed in
5.1.5
What to do
Update Cross-site scripting (XSS) vulnerability in the Wordfence Security to 5.1.5 or newer.
Full record and what to do →NVD record techdefencelabs.com wordfence.com
Apr 23, 2018the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for: Cross-site scripting (XSS)CVE-2018-10301 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post.
Product
the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for
Fixed in
1.3.1
What to do
Update the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for to 1.3.1 or newer.
Full record and what to do →NVD record medium.com wpvulndb.com
Apr 23, 2018Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2018-10300 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio.
Product
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD
Fixed in
1.3.1
What to do
Update Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD to 1.3.1 or newer.
Full record and what to do →NVD record medium.com wpvulndb.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5656 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5655 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5654 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREE_Access_Token parameter.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress.CVE-2018-5653 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizar_pffree_settings_save_get-users parameter.
Product
weblizar-pinterest-feeds
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update weblizar-pinterest-feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.CVE-2018-5290 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.CVE-2018-5288 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Dec 29, 2017The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtainCVE-2015-3302 · WordPress plugins & themes · reported by MITREHigh 7.5
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Product
TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin)
Fixed in
1.3.9.3
What to do
Update TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) to 1.3.9.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 2, 2017wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks CVE-2017-17094 · WordPress plugins & themes · reported by MITREMedium 5.4
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.
Fixed in
4.9.1
What to do
Update the plugin to 4.9.1 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Nov 9, 2017Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows reCVE-2017-16758 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "access_token" parameter.
Product
Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed
Fixed in
1.3
What to do
Update Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed to 1.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Nov 2, 2017WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugCVE-2017-16510 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.
Fixed in
4.8.3
What to do
Update the plugin to 4.8.3 or newer.
Full record and what to do →NVD record securityfocus.com blog.ircmaxell.com
Jul 17, 2017WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected siteCVE-2017-1000038 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site
Affected
3.5.7.1 to 3.5.7.1
What to do
Affects 3.5.7.1 to 3.5.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Jul 7, 2017The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.CVE-2017-10991 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.
Product
WP Statistics
Affected
up to 12.0.9
What to do
Affects up to 12.0.9. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lorexxar.cn lorexxar.cn

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.