Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
35added in the last 30 days
456new WordPress flaws this week
390,714entries in the database

158 results · page 4 of 4

  • Oct 24, 2017Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.CVE-2017-15863 · WordPress plugins & themes · reported by MITREMedium 6.1

    Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.

    Product
    Cross Site Scripting (XSS) exists in the wp-noexternallinks
    Fixed in
    3.5.19
    What to do
    Update Cross Site Scripting (XSS) exists in the wp-noexternallinks to 3.5.19 or newer.

    Full record and what to do →NVD recordlists.openwall.networdpress.org

  • Aug 2, 2016Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrary web script or HTMLCVE-2016-4833 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1

    Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Product
    Cross-site scripting (XSS) vulnerability in the Nofollow Links
    Fixed in
    1.0.11
    What to do
    Update Cross-site scripting (XSS) vulnerability in the Nofollow Links to 1.0.11 or newer.

    Full record and what to do →NVD recordjvn.jpjvndb.jvn.jp

  • Oct 27, 2014wp-links/links.all.php in WordPress 0.70: PHP remote file inclusionCVE-2003-1599 · WordPress plugins & themes · reported by Red HatHigh 7.5

    PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable.

    Product
    wp-links/links.all.php in WordPress 0.70
    What to do
    Update wp-links/links.all.php in WordPress 0.70 to the newest version.

    Full record and what to do →NVD recordkernelpanik.orgopenwall.com

  • Jul 2, 2014Cross-site scripting (XSS) vulnerability in inpage.tpl.php in the Keyword Strategy Internal Links plugin 2.0 and earlier for WordPress allows remote attackers tCVE-2014-4537 · WordPress plugins & themes · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in inpage.tpl.php in the Keyword Strategy Internal Links plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) sort, (2) search, or (3) dir parameter.

    Product
    Keyword Strategy Internal Links
    Affected
    up to 2.0
    What to do
    Affects up to 2.0. Update Keyword Strategy Internal Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

  • Apr 21, 2012wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conductCVE-2012-2403 · WordPress plugins & themes · reported by MITREMedium 4.3

    wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

    Fixed in
    3.3.2
    What to do
    Update the plugin to 3.3.2 or newer.

    Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org

  • Jul 30, 2010SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url CVE-2010-2924 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information.

    Product
    myLinksDump
    What to do
    Update myLinksDump to the newest version.

    Full record and what to do →NVD recordosvdb.orgsecunia.com

  • Jan 31, 2008deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for: Cross-site request forgery (CSRF)CVE-2008-0508 · WordPress plugins & themes · reported by MITREMedium 6.8

    Cross-site request forgery (CSRF) vulnerability in deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the oldstructure (aka dean_pm_config[oldstructure]) configuration setting as administrators via the old_struct parameter in a deans_permalinks_migration.php action to wp-admin/options-general.php, as demonstrated by placing an XSS sequence in this setting.

    Product
    deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for
    What to do
    Update deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for to the newest version.

    Full record and what to do →NVD recordg30rg3x.comg30rg3x.com

  • Apr 17, 2006Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions beforCVE-2006-1796 · WordPress plugins & themes · reported by MITREMedium 6.8

    Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).

    Fixed in
    2.0.1
    What to do
    Update the plugin to 2.0.1 or newer.

    Full record and what to do →NVD recordbugs.debian.orgtrac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.