Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

572new WordPress flaws this week

398,071entries in the database

15,625 results · page 300 of 313

Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.CVE-2019-19981 · WordPress plugins & themes · reported by MITREMedium 5.4
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Dec 25, 2019A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affectinCVE-2019-19979 · WordPress plugins & themes · reported by MITREHigh 8.8
A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS.
Fixed in
5.0.6
What to do
Update the plugin to 5.0.6 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Dec 13, 2019The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS).CVE-2019-17599 · WordPress plugins & themes · reported by MITREMedium 6.1
The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.
Product
quiz-master-next (aka Quiz And Survey Master)
Fixed in
6.3.5
What to do
Update quiz-master-next (aka Quiz And Survey Master) to 6.3.5 or newer.
Full record and what to do →NVD record github.com github.com
Dec 11, 2019Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbCVE-2013-5978 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977.
Product
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite
Fixed in
1.5.1.15
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite to 1.5.1.15 or newer.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Nov 18, 2019The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album,CVE-2019-14467 · WordPress plugins & themes · reported by MITREHigh 7.8
The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 13, 2019The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS).CVE-2019-17550 · WordPress plugins & themes · reported by MITREMedium 6.1
The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2s_id parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.
Product
Blog2Social
Fixed in
5.9.0
What to do
Update Blog2Social to 5.9.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 13, 2019The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS).CVE-2019-17515 · WordPress plugins & themes · reported by MITREMedium 6.1
The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and inc/cleantalk-comments.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.
Product
CleanTalk cleantalk-spam-protect
Fixed in
5.127.4
What to do
Update CleanTalk cleantalk-spam-protect to 5.127.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 17, 2019WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.CVE-2019-17674 · WordPress plugins & themes · reported by MITREMedium 5.4
WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record blog.wpscan.org seclists.org
Oct 10, 2019The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.CVE-2015-9465 · WordPress plugins & themes · reported by MITREHigh 8.8
The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.
Product
yet-another-stars-rating
Fixed in
0.9.1
What to do
Update yet-another-stars-rating to 0.9.1 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated storCVE-2019-17239 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
Product
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameCVE-2015-9451 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.CVE-2015-9450 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
Product
plugmatter-optin-feature-box-lite
Fixed in
2.0.14
What to do
Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 26, 2019The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to impCVE-2019-16524 · WordPress plugins & themes · reported by MITREMedium 4.8
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.
Product
easy-fancybox
Fixed in
1.8.18
What to do
Update easy-fancybox to 1.8.18 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 25, 2019The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or taCVE-2015-9434 · WordPress plugins & themes · reported by MITREMedium 6.5
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Product
kiwi-logo-carousel
Fixed in
1.7.2
What to do
Update kiwi-logo-carousel to 1.7.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.CVE-2015-9410 · WordPress plugins & themes · reported by MITREMedium 5.4
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.
Affected
6.0.4 to 6.0.4
What to do
Affects 6.0.4 to 6.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com github.com
Sep 20, 2019The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.CVE-2016-11013 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.
Product
wp-listings
Fixed in
2.0.2
What to do
Update wp-listings to 2.0.2 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.CVE-2016-11006 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.CVE-2016-10996 · WordPress plugins & themes · reported by MITREMedium 5.3
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
Product
optinmonster
Fixed in
1.1.4.6
What to do
Update optinmonster to 1.1.4.6 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 17, 2019The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.CVE-2016-10982 · WordPress plugins & themes · reported by MITREHigh 8.8
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
Product
kento-post-view-counter
Affected
up to 2.8
What to do
Affects up to 2.8. Update kento-post-view-counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org openwall.com
Sep 17, 2019The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.CVE-2016-10977 · WordPress plugins & themes · reported by MITREMedium 6.5
The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
Product
nelio-ab-testing
Fixed in
4.5.0
What to do
Update nelio-ab-testing to 4.5.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 16, 2019The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.CVE-2016-10957 · WordPress plugins & themes · reported by MITREMedium 6.1
The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
Product
Akal
Affected
up to 2016-08-22
What to do
Affects up to 2016-08-22. Update Akal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com saotn.org
Sep 13, 2019The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.CVE-2016-10942 · WordPress plugins & themes · reported by MITRECritical 9.8
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
Product
podlove-podcasting-plugin-for-wordpress
Fixed in
2.3.16
What to do
Update podlove-podcasting-plugin-for-wordpress to 2.3.16 or newer.
Full record and what to do →NVD record blog.ripstech.com github.com
Sep 13, 2019The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.CVE-2016-10941 · WordPress plugins & themes · reported by MITREMedium 6.1
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
Product
podlove-podcasting-plugin-for-wordpress
Fixed in
2.3.16
What to do
Update podlove-podcasting-plugin-for-wordpress to 2.3.16 or newer.
Full record and what to do →NVD record blog.ripstech.com github.com
Sep 11, 2019WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacCVE-2019-16222 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record core.trac.wordpress.org github.com
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.CVE-2019-16118 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.CVE-2019-16117 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-15872 · WordPress plugins & themes · reported by MITRECritical 9.8
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.CVE-2019-15871 · WordPress plugins & themes · reported by MITREMedium 4.3
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.CVE-2019-15831 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
Product
visitors-traffic-real-time-statistics
Fixed in
1.12
What to do
Update visitors-traffic-real-time-statistics to 1.12 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.CVE-2019-15821 · WordPress plugins & themes · reported by MITREHigh 7.5
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Product
bold-page-builder
Fixed in
2.3.2
What to do
Update bold-page-builder to 2.3.2 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.CVE-2019-15820 · WordPress plugins & themes · reported by MITREMedium 6.1
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
Product
login-or-logout-menu-item
Fixed in
1.2.0
What to do
Update login-or-logout-menu-item to 1.2.0 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15819 · WordPress plugins & themes · reported by MITRECritical 9.8
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Product
nd-restaurant-reservations
Fixed in
1.5
What to do
Update nd-restaurant-reservations to 1.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The easy-property-listings plugin before 3.4 for WordPress has XSS.CVE-2019-15817 · WordPress plugins & themes · reported by MITREMedium 6.1
The easy-property-listings plugin before 3.4 for WordPress has XSS.
Product
easy-property-listings
Fixed in
3.4
What to do
Update easy-property-listings to 3.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.CVE-2019-15816 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
Product
wp-private-content-plus
Fixed in
2.0
What to do
Update wp-private-content-plus to 2.0 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 29, 2019The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15771 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-shortcodes
Fixed in
6.0
What to do
Update nd-shortcodes to 6.0 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.CVE-2019-15777 · WordPress plugins & themes · reported by MITREMedium 5.4
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
Product
shapepress-dsgvo
Fixed in
2.2.19
What to do
Update shapepress-dsgvo to 2.2.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15775 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-learning
Fixed in
4.8
What to do
Update nd-learning to 4.8 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15774 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-booking
Fixed in
2.5
What to do
Update nd-booking to 2.5 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15773 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-travel
Fixed in
1.7
What to do
Update nd-travel to 1.7 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15772 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-donations
Fixed in
1.4
What to do
Update nd-donations to 1.4 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 27, 2019The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.CVE-2017-18591 · WordPress plugins & themes · reported by MITREMedium 6.1
The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
Product
gd-rating-system
Fixed in
2.1
What to do
Update gd-rating-system to 2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.CVE-2019-15648 · WordPress plugins & themes · reported by MITREMedium 6.5
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
Product
insert-or-embed-articulate-content-into-wordpress
Fixed in
4.29991
What to do
Update insert-or-embed-articulate-content-into-wordpress to 4.29991 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.CVE-2015-9345 · WordPress plugins & themes · reported by MITREHigh 7.5
The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
Product
link-log
Fixed in
2.0
What to do
Update link-log to 2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.CVE-2018-20983 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.
Product
wp-retina-2x
Fixed in
5.2.3
What to do
Update wp-retina-2x to 5.2.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.CVE-2017-18584 · WordPress plugins & themes · reported by MITREHigh 7.5
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
Product
post-pay-counter
Fixed in
2.731
What to do
Update post-pay-counter to 2.731 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10927 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.11
What to do
Update nelio-ab-testing to 4.5.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10926 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.9
What to do
Update nelio-ab-testing to 4.5.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.CVE-2016-10925 · WordPress plugins & themes · reported by MITREMedium 6.1
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
Product
peters-login-redirect
Fixed in
2.9.1
What to do
Update peters-login-redirect to 2.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.CVE-2015-9337 · WordPress plugins & themes · reported by MITREHigh 7.5
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Product
profile-builder
Fixed in
2.1.4
What to do
Update profile-builder to 2.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.CVE-2018-20982 · WordPress plugins & themes · reported by MITREMedium 6.1
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
Product
media-library-assistant
Fixed in
2.74
What to do
Update media-library-assistant to 2.74 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.