Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,944 results · page 29 of 39

Nov 13, 2019In createProjectionMapForQuery of TvProvider.java, there is possible SQL injection.CVE-2019-2211 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In createProjectionMapForQuery of TvProvider.java, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135269669
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Nov 12, 2019mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text formCVE-2010-4177 · Other software · mysql-gui-tools · reported by Red HatMedium 5.5
mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.
Product
mysql-gui-tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Nov 5, 2019The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-tCVE-2013-5123 · Other software · Pypa · reported by MITREMedium 5.9
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
Product
PIP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Oct 31, 2019Mumble: murmur-server has DoS due to malformed client queryCVE-2010-2490 · Other software · Mumble · reported by Red HatMedium 6.5
Mumble: murmur-server has DoS due to malformed client query
Product
Mumble
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 23, 2019In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HCVE-2019-16977 · Other software · Fusionpbx · reported by MITREMedium 6.1
In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
Product
Fusionpbx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com resp3ctblog.wordpress.com
Oct 23, 2019In FusionPBX up to 4.5.7, the file app\destinations\destination_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected CVE-2019-16976 · Other software · Fusionpbx · reported by MITREMedium 6.1
In FusionPBX up to 4.5.7, the file app\destinations\destination_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
Product
Fusionpbx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com resp3ctblog.wordpress.com
Oct 22, 2019In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leCVE-2019-16973 · Other software · Fusionpbx · reported by MITREMedium 6.1
In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
Product
Fusionpbx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com resp3ctblog.wordpress.com
Oct 22, 2019The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.CVE-2015-9500 · WordPress plugins & themes · reported by MITREMedium 6.1
The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
Affected
1.3.3 to 1.3.3
What to do
Affects 1.3.3 to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 21, 2019In FusionPBX up to v4.5.7, the file app\contacts\contact_import.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML,CVE-2019-16987 · Other software · Fusionpbx · reported by MITREMedium 6.1
In FusionPBX up to v4.5.7, the file app\contacts\contact_import.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
Product
Fusionpbx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com resp3ctblog.wordpress.com
Oct 17, 2019In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.CVE-2019-17671 · WordPress plugins & themes · reported by MITREMedium 5.3
In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org core.trac.wordpress.org
Oct 16, 2019"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap.CVE-2019-17624 · Other software · X.org · reported by MITREHigh 7.8
"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 times, an attacker can cause a denial of service (application crash) or possibly have unspecified other impact. Note: It is disputed if the X.Org X Server is involved or if there is a stack overflow.
Product
X Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Oct 14, 2019idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincpCVE-2019-17583 · Other software · Idreamsoft · reported by MITREHigh 7.5
idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer.
Product
Icms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 10, 2019The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1CVE-2015-9479 · WordPress plugins & themes · reported by MITRECritical 9.8
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
Product
ACF-Frontend-Display
Affected
up to 2015-07-03
What to do
Affects up to 2015-07-03. Update ACF-Frontend-Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 10, 2019prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS.CVE-2015-9478 · Other software · No-margin-for-error · reported by MITREMedium 6.1
prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS.
Product
Prettyphoto
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 10, 2019The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.CVE-2019-17072 · WordPress plugins & themes · reported by MITRECritical 9.8
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
Affected
1.0.9 to 1.0.9
What to do
Affects 1.0.9 to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordpress.org
Oct 9, 2019Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignoreCVE-2019-17426 · Other software · Mongoosejs · reported by MITRECritical 9.1
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
Product
Mongoose
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 9, 2019A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendCVE-2019-6467 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.
Product
BIND 9
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.isc.org synology.com
Oct 3, 2019Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query.CVE-2019-16866 · Other software · Nlnetlabs · reported by MITREHigh 7.5
Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.
Product
Unbound
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.fedoraproject.org
Sep 26, 2019The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.CVE-2015-9444 · WordPress plugins & themes · reported by MITREMedium 6.1
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
Affected
1.3.0 to 1.3.0
What to do
Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Aug 28, 2019The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9359 · WordPress plugins & themes · reported by MITREMedium 6.1
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Jetpack
Fixed in
3.4.3
What to do
Update Jetpack to 3.4.3 or newer.
Full record and what to do →NVD record blog.sucuri.net jetpack.com
Aug 28, 2019iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9379 · WordPress plugins & themes · reported by MITREMedium 6.1
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
iThemes Builder Style Manager
Fixed in
0.7.7
What to do
Update iThemes Builder Style Manager to 0.7.7 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9378 · WordPress plugins & themes · reported by MITREMedium 6.1
iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
iThemes Builder Theme Market
Fixed in
5.1.27
What to do
Update iThemes Builder Theme Market to 5.1.27 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9377 · WordPress plugins & themes · reported by MITREMedium 6.1
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
iThemes Builder Theme Depot
Fixed in
5.0.30
What to do
Update iThemes Builder Theme Depot to 5.0.30 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9376 · WordPress plugins & themes · reported by MITREMedium 6.1
iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
iThemes Mobile
Fixed in
1.2.8
What to do
Update iThemes Mobile to 1.2.8 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9375 · WordPress plugins & themes · reported by MITREMedium 6.1
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Table Rate Shipping Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Table Rate Shipping Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9374 · WordPress plugins & themes · reported by MITREMedium 6.1
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Stripe Add-on for iThemes Exchange
Fixed in
1.2.0
What to do
Update Stripe Add-on for iThemes Exchange to 1.2.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9373 · WordPress plugins & themes · reported by MITREMedium 6.1
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
PayPal Pro Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update PayPal Pro Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9372 · WordPress plugins & themes · reported by MITREMedium 6.1
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Membership Add-on for iThemes Exchange
Fixed in
1.3.0
What to do
Update Membership Add-on for iThemes Exchange to 1.3.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9371 · WordPress plugins & themes · reported by MITREMedium 6.1
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Manual Purchases Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Manual Purchases Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9370 · WordPress plugins & themes · reported by MITREMedium 6.1
Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Invoices Add-on for iThemes Exchange
Fixed in
1.4.0
What to do
Update Invoices Add-on for iThemes Exchange to 1.4.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9369 · WordPress plugins & themes · reported by MITREMedium 6.1
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Easy US Sales Taxes Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Easy US Sales Taxes Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9368 · WordPress plugins & themes · reported by MITREMedium 6.1
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange
Fixed in
1.2.0
What to do
Update Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange to 1.2.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9367 · WordPress plugins & themes · reported by MITREMedium 6.1
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Easy Canadian Sales Taxes Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Easy Canadian Sales Taxes Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9366 · WordPress plugins & themes · reported by MITREMedium 6.1
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Custom URL Tracking Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Custom URL Tracking Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9365 · WordPress plugins & themes · reported by MITREMedium 6.1
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Authorize.net Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Authorize.net Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 20192Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9364 · WordPress plugins & themes · reported by MITREMedium 6.1
2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
2Checkout Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update 2Checkout Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9363 · WordPress plugins & themes · reported by MITREMedium 6.1
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
iThemes Exchange
Fixed in
1.12.0
What to do
Update iThemes Exchange to 1.12.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9362 · WordPress plugins & themes · reported by MITREMedium 6.1
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Post Connector
Fixed in
1.0.4
What to do
Update Post Connector to 1.0.4 or newer.
Full record and what to do →NVD record barrykooij.com barrykooij.com
Aug 28, 2019The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9361 · WordPress plugins & themes · reported by MITREMedium 6.1
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Related Posts
Fixed in
1.8.2
What to do
Update Related Posts to 1.8.2 or newer.
Full record and what to do →NVD record blog.sucuri.net barrykooij.com
Aug 28, 2019The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9360 · WordPress plugins & themes · reported by MITREMedium 6.1
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
updraftplus
Fixed in
1.9.64
What to do
Update updraftplus to 1.9.64 or newer.
Full record and what to do →NVD record blog.sucuri.net updraftplus.com
Aug 28, 2019The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9358 · WordPress plugins & themes · reported by MITREMedium 6.1
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
feedwordpress
Fixed in
2015.0514
What to do
Update feedwordpress to 2015.0514 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.CVE-2015-9356 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
Product
wp-vipergb
Fixed in
1.3.16
What to do
Update wp-vipergb to 1.3.16 or newer.
Full record and what to do →NVD record make.wordpress.org wordpress.org
Aug 26, 2019Discourse 2.3.2 sends the CSRF token in the query string.CVE-2019-15515 · Other software · Discourse · reported by MITREMedium 6.5
Discourse 2.3.2 sends the CSRF token in the query string.
Product
Discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 26, 2019HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java.CVE-2019-15569 · Other software · GOV · reported by MITRECritical 9.8
HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java.
Product
Ccd-data-store-api
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 22, 2019The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.CVE-2017-18577 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
Product
mailchimp-for-wp
Fixed in
4.1.8
What to do
Update mailchimp-for-wp to 4.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.CVE-2015-9321 · WordPress plugins & themes · reported by MITREMedium 6.1
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Product
shortcode-factory
Fixed in
1.1.1
What to do
Update shortcode-factory to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.CVE-2015-9320 · WordPress plugins & themes · reported by MITREMedium 6.1
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
Product
option-tree
Fixed in
2.5.4
What to do
Update option-tree to 2.5.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can CVE-2019-0333 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.
Product
SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Aug 13, 2019The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.CVE-2015-9296 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Product
download-monitor
Fixed in
1.7.1
What to do
Update download-monitor to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.CVE-2015-9294 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.5
What to do
Update all-in-one-wp-security-and-firewall to 3.9.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.