Updated 35 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

178 results · page 4 of 4

Jul 5, 2019Related YouTube Videos versions prior to 1.9.9: Cross-site request forgery (CSRF)CVE-2019-5980 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Related YouTube Videos versions prior to 1.9.9
Fixed in
1.9.9
What to do
Update Related YouTube Videos versions prior to 1.9.9 to 1.9.9 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 9, 2019The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (itCVE-2019-11869 · WordPress plugins & themes · reported by MITREMedium 6.1
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.
Affected
5.12.94 to 5.12.94
What to do
Affects 5.12.94 to 5.12.94. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
Mar 10, 2019The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition areCVE-2019-9646 · WordPress plugins & themes · reported by MITREMedium 6.1
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."
Product
Contact Form Email
Fixed in
1.2.66
What to do
Update Contact Form Email to 1.2.66 or newer.
Full record and what to do →NVD record lists.openwall.net security-consulting.icu
Apr 25, 2018The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters iCVE-2014-5014 · WordPress plugins & themes · reported by MITRECritical 9.8
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
Product
WordPress Flash Uploader
Fixed in
3.1.3
What to do
Update WordPress Flash Uploader to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 7, 2018inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt.CVE-2018-7204 · WordPress plugins & themes · reported by MITREHigh 7.5
inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and contains database credentials, salts, etc. These files have been indexed by Google and a simple dork will find affected sites.
Product
inc/logger.php in the Giribaz File Manager
Fixed in
5.0.2
What to do
Update inc/logger.php in the Giribaz File Manager to 5.0.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 29, 2017The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.phpCVE-2015-9233 · WordPress plugins & themes · reported by MITREHigh 8.8
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.
Product
cp-contact-form-with-paypal (aka CP Contact Form with PayPal)
Fixed in
1.1.6
What to do
Update cp-contact-form-with-paypal (aka CP Contact Form with PayPal) to 1.1.6 or newer.
Full record and what to do →NVD record seclists.org seclists.org
Sep 26, 2017The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.CVE-2017-14751 · WordPress plugins & themes · reported by MITREMedium 6.1
The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record bbs.microdesktop.com securityfocus.com
Aug 20, 2017The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() iCVE-2017-12977 · WordPress plugins & themes · reported by MITREHigh 7.2
The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.
Product
Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery
Fixed in
1.3.51
What to do
Update Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery to 1.3.51 or newer.
Full record and what to do →NVD record github.com wordpress.org
Aug 18, 2017Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.CVE-2017-12948 · WordPress plugins & themes · reported by MITREMedium 6.1
Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.
Product
PressForward
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update PressForward to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
May 23, 2017upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variabCVE-2015-5682 · WordPress plugins & themes · reported by MITREHigh 7.5
upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com vapid.dhs.org
May 18, 2017In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.CVE-2017-9063 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/inCVE-2016-5835 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 5, 2015Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.CVE-2014-9688 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
Product
Unspecified vulnerability in the Ninja Forms
Fixed in
2.8.10
What to do
Update Unspecified vulnerability in the Ninja Forms to 2.8.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jun 2, 2014SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via uCVE-2014-3937 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
SQL injection vulnerability in the Contextual Related Posts
Fixed in
1.8.10.2
What to do
Update SQL injection vulnerability in the Contextual Related Posts to 1.8.10.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jun 2, 2014Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin before 2.6.2 for WordPress allows remote attackers to hijack the authenticCVE-2013-3476 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin before 2.6.2 for WordPress allows remote attackers to hijack the authentication of users for requests that change settings via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts
Fixed in
2.6.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts to 2.6.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jun 2, 2014Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of uCVE-2013-3257 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Related Posts
Fixed in
2.7.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Related Posts to 2.7.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Jun 2, 2014Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentiCVE-2013-2710 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts
Fixed in
1.8.7
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts to 1.8.7 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 27, 2014Cross-site request forgery (CSRF) vulnerability in the Related Posts by Zemanta plugin before 1.3.2 for WordPress allows remote attackers to hijack the authentiCVE-2013-3477 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Related Posts by Zemanta plugin before 1.3.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change settings via unknown vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the Related Posts by Zemanta
Fixed in
1.3.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Related Posts by Zemanta to 1.3.2 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 9, 2014WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includeCVE-2014-0165 · WordPress plugins & themes · reported by Red HatMedium 4
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Fixed in
3.7.2
What to do
Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD record codex.wordpress.org codex.wordpress.org
Jul 8, 2013The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side RequeCVE-2013-2199 · WordPress plugins & themes · reported by Red HatMedium 4.3
The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.
Fixed in
3.5.2
What to do
Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD record codex.wordpress.org wordpress.org
Sep 6, 2012Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads."CVE-2012-4874 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads."
Product
Unspecified vulnerability in the Another WordPress Classifieds
Fixed in
2.0
What to do
Update Unspecified vulnerability in the Another WordPress Classifieds to 2.0 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Aug 14, 2012The ShareYourCart plugin 1.7.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors related to the SDK.CVE-2012-4332 · WordPress plugins & themes · reported by MITREMedium 5
The ShareYourCart plugin 1.7.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors related to the SDK.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 10, 2011wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibCVE-2011-3130 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection.
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 10, 2011Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."CVE-2011-3125 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Aug 10, 2011Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."CVE-2011-3122 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 28, 2011Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress aCVE-2011-0760 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the (1) wp_relatedposts_title, (2) wp_relatedposts_num, or (3) wp_relatedposts_type parameter.
Product
WP Related Posts
What to do
Update WP Related Posts to the newest version.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Jul 8, 2009SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via thCVE-2009-2383 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.
Product
Related Sites
What to do
Update Related Sites to the newest version.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Jul 25, 2007a certain index.php installation script related to the: Cross-site scripting (XSS)CVE-2007-4014 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in a certain index.php installation script related to the (1) Blix 0.9.1, (2) Blixed 1.0, and (3) BlixKrieg (Blix Krieg) 2.2 themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
a certain index.php installation script related to the
What to do
Update a certain index.php installation script related to the to the newest version.
Full record and what to do →NVD record secunia.com secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.