Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

1,938 results · page 39 of 39

Mar 10, 2020controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via tCVE-2018-14502 · WordPress plugins & themes · reported by MITRECritical 9.8
controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.
Product
controllers/quizzes.php in the Kiboko Chained Quiz
Fixed in
1.0.9
What to do
Update controllers/quizzes.php in the Kiboko Chained Quiz to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 9, 2020The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functionCVE-2020-10257 · WordPress plugins & themes · reported by MITRECritical 9.8
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Product
ThemeREX Addons
Fixed in
2020-03-09
What to do
Update ThemeREX Addons to 2020-03-09 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their CVE-2020-9456 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Dec 27, 2019In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a pCVE-2019-20043 · WordPress plugins & themes · reported by MITREMedium 4.3
In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record core.trac.wordpress.org github.com
Nov 8, 2019A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers.CVE-2019-17661 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC.
Product
codepress-admin-columns (aka Admin Columns)
Affected
3.4.6 to 3.4.6
What to do
Affects 3.4.6 to 3.4.6. Update codepress-admin-columns (aka Admin Columns) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record www2.deloitte.com www2.deloitte.com
Oct 10, 2019The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.CVE-2015-9457 · WordPress plugins & themes · reported by MITREHigh 7.2
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.
Product
pretty-link
Fixed in
1.6.8
What to do
Update pretty-link to 1.6.8 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Oct 7, 2019The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbCVE-2015-9456 · WordPress plugins & themes · reported by MITREMedium 6.5
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.
Product
orbisius-child-theme-creator
Fixed in
1.2.8
What to do
Update orbisius-child-theme-creator to 1.2.8 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 27, 2019In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full paCVE-2019-16902 · WordPress plugins & themes · reported by MITREHigh 7.5
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.
Product
ARforms
Affected
3.7.1 to 3.7.1
What to do
Affects 3.7.1 to 3.7.1. Update ARforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record almorabea.net arformsplugin.com
Sep 20, 2019The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.CVE-2016-11012 · WordPress plugins & themes · reported by MITREMedium 5.4
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
Product
sola-support-tickets
Fixed in
3.13
What to do
Update sola-support-tickets to 3.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.CVE-2016-11010 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.CVE-2016-11009 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.CVE-2016-11008 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.CVE-2016-11007 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.CVE-2016-11006 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
Product
wp-invoice
Fixed in
4.1.1
What to do
Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 20, 2019The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.CVE-2016-10996 · WordPress plugins & themes · reported by MITREMedium 5.3
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
Product
optinmonster
Fixed in
1.1.4.6
What to do
Update optinmonster to 1.1.4.6 or newer.
Full record and what to do →NVD record pritect.net wordpress.org
Sep 17, 2019The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.CVE-2016-10983 · WordPress plugins & themes · reported by MITREMedium 6.5
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
Product
ghost
Fixed in
0.5.6
What to do
Update ghost to 0.5.6 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 16, 2019The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.CVE-2016-10972 · WordPress plugins & themes · reported by MITRECritical 9.8
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
Product
newspaper
Fixed in
6.7.2
What to do
Update newspaper to 6.7.2 or newer.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Sep 16, 2019The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.CVE-2016-10971 · WordPress plugins & themes · reported by MITRECritical 9.8
The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
Product
MemberSonic Lite
Fixed in
1.302
What to do
Update MemberSonic Lite to 1.302 or newer.
Full record and what to do →NVD record pritect.net pritect.net
Sep 10, 2019The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.CVE-2017-18596 · WordPress plugins & themes · reported by MITREHigh 8.8
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
Product
elementor
Fixed in
1.8.0
What to do
Update elementor to 1.8.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 9, 2019The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath toCVE-2018-21013 · WordPress plugins & themes · reported by MITRECritical 9.8
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.
Product
Swape
Fixed in
1.2.1
What to do
Update Swape to 1.2.1 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 8, 2019SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameCVE-2019-16119 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.
Product
SQL injection in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update SQL injection in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.CVE-2019-16118 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
Product
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery)
Fixed in
1.5.35
What to do
Update Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) to 1.5.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Aug 28, 2019The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.CVE-2017-18593 · WordPress plugins & themes · reported by MITREMedium 6.1
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
Product
updraftplus
Fixed in
1.13.5
What to do
Update updraftplus to 1.13.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.CVE-2015-9337 · WordPress plugins & themes · reported by MITREHigh 7.5
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Product
profile-builder
Fixed in
2.1.4
What to do
Update profile-builder to 2.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.CVE-2017-18543 · WordPress plugins & themes · reported by MITRECritical 9.8
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, whicCVE-2018-19488 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account.
Product
WP-jobhunt
Fixed in
2.4
What to do
Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.phpCVE-2018-19487 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.
Product
WP-jobhunt
Fixed in
2.4
What to do
Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 26, 2019Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers CVE-2019-6703 · WordPress plugins & themes · reported by MITRECritical 9.8
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Product
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Oct 5, 2018The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archCVE-2014-10076 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack.
Affected
2.2.4 to 2.2.4
What to do
Affects 2.2.4 to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com vapidlabs.com
Apr 10, 2018The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveragiCVE-2014-1889 · WordPress plugins & themes · reported by MITREMedium 6.5
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.
Product
Group creation process in the Buddypress
Fixed in
1.9.2
What to do
Update Group creation process in the Buddypress to 1.9.2 or newer.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jan 2, 2018Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker controlCVE-2017-1000434 · WordPress plugins & themes · reported by MITREMedium 6.1
Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker controlled page classes/Furigana.php: header('location:'.urldecode($_GET['furikake-redirect']));
Affected
0.1.0 to 0.1.0
What to do
Affects 0.1.0 to 0.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cjc.im wpvulndb.com
Aug 18, 2017classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameCVE-2017-12947 · WordPress plugins & themes · reported by MITREHigh 7.2
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.
Product
classes\controller\admin\modals.php in the Easy Modal
Fixed in
2.1.0
What to do
Update classes\controller\admin\modals.php in the Easy Modal to 2.1.0 or newer.
Full record and what to do →NVD record defensecode.com wordpress.org
Aug 18, 2017classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameteCVE-2017-12946 · WordPress plugins & themes · reported by MITREHigh 7.2
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.
Product
classes\controller\admin\modals.php in the Easy Modal
Fixed in
2.1.0
What to do
Update classes\controller\admin\modals.php in the Easy Modal to 2.1.0 or newer.
Full record and what to do →NVD record defensecode.com wordpress.org
Apr 2, 2017The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not requiCVE-2017-1001000 · WordPress plugins & themes · reported by 46fe6300-5254-4a98-9594-a9567bec8179High 7.5
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
Fixed in
4.7.2
What to do
Update the plugin to 4.7.2 or newer.
Full record and what to do →NVD record openwall.com securitytracker.com
Mar 11, 2017In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.CVE-2017-6815 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jan 14, 2017wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listinCVE-2017-5487 · WordPress plugins & themes · reported by MITREMedium 5.3
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Dec 5, 2014The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remCVE-2014-8877 · WordPress plugins & themes · reported by MITREHigh 10
The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.
Product
alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager
Fixed in
2.0.4
What to do
Update alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager to 2.0.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com itas.vn
Aug 22, 2014Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.CVE-2014-5368 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.
Product
WP Content Source Control (wp-source-control)
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update WP Content Source Control (wp-source-control) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.