Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
182 results · page 4 of 4
May 16, 2022WPCargo Track & Trace: Does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the pageCVE-2022-1436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
May 16, 2022WPCargo Track & Trace: Does not sanitize and escapes some of its settingsCVE-2022-1435 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
May 16, 2022AGIL: Accepts all zip files and automatically extracts the zip file without validating the extracted file typeCVE-2021-25119 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
- Product
- AGIL
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update AGIL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Plezi: Has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable optionCVE-2022-0680 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue
- Product
- Plezi
- Fixed in
- 1.0.3
- What to do
- Update Plezi to 1.0.3 or newer.
Mar 14, 2022Simple Tracking: Does not sanitise and escape its settingsCVE-2022-0700 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Simple Tracking
- Fixed in
- 1.7
- What to do
- Update Simple Tracking to 1.7 or newer.
Mar 14, 2022WPCargo Track & Trace: Contains a fileCVE-2021-25003 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.0
- What to do
- Update WPCargo Track & Trace to 6.9.0 or newer.
Mar 7, 2022test parameter of the xmlfeed in the Tradetracker-Store: Is not sanitisedCVE-2021-24778 · WordPress plugins & themes · reported by WPScanHigh 7.2
The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- test parameter of the xmlfeed in the Tradetracker-Store
- Fixed in
- 4.6.60
- What to do
- Update test parameter of the xmlfeed in the Tradetracker-Store to 4.6.60 or newer.
Feb 14, 2022Futurio Extra: Is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the databaseCVE-2021-25109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
- Product
- Futurio Extra
- Fixed in
- 1.6.3
- What to do
- Update Futurio Extra to 1.6.3 or newer.
Jan 24, 2022Orders Tracking for WooCommerce: Does not sanitise and escape the file_url before outputting it back in an admin pageCVE-2021-25062 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Orders Tracking for WooCommerce
- Fixed in
- 1.1.10
- What to do
- Update Orders Tracking for WooCommerce to 1.1.10 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 19, 2022Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.CVE-2021-44777 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).
- Affected
- up to 5.2.6
- What to do
- Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 16, 2021PhoneTrack Meu Site Manager: Does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the pageCVE-2021-24534 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
- Product
- PhoneTrack Meu Site Manager
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update PhoneTrack Meu Site Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2021Autoptimize: Attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' featureCVE-2021-24377 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
- Product
- Autoptimize
- Fixed in
- 2.7.8
- What to do
- Update Autoptimize to 2.7.8 or newer.
Apr 5, 2021In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extractCVE-2021-24160 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.
- Fixed in
- 4.0.4
- What to do
- Update the plugin to 4.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jan 21, 2020The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.CVE-2020-6849 · WordPress plugins & themes · reported by MITREHigh 8.8
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.
- Product
- marketo-forms-and-tracking
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update marketo-forms-and-tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Sep 13, 2019The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.CVE-2016-10955 · WordPress plugins & themes · reported by MITRECritical 9.8
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
- Product
- cysteme-finder
- Fixed in
- 1.4
- What to do
- Update cysteme-finder to 1.4 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Sep 10, 2019The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.CVE-2017-18605 · WordPress plugins & themes · reported by MITRECritical 9.8
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
- Product
- gravitate-qa-tracker
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update gravitate-qa-tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 28, 2019Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9366 · WordPress plugins & themes · reported by MITREMedium 6.1
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- Product
- Custom URL Tracking Add-on for iThemes Exchange
- Fixed in
- 1.1.0
- What to do
- Update Custom URL Tracking Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD recordblog.sucuri.netithemes.com
Aug 22, 2019The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.CVE-2017-18570 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
- Product
- cforms2
- Fixed in
- 14.13
- What to do
- Update cforms2 to 14.13 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.CVE-2017-18554 · WordPress plugins & themes · reported by MITREMedium 6.1
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
- Product
- analytics-tracker
- Fixed in
- 1.1.1
- What to do
- Update analytics-tracker to 1.1.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into thCVE-2017-1002007 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
- Affected
- 1.5 to 1.5
- What to do
- Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts intoCVE-2017-1002006 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
- Affected
- 1.5 to 1.5
- What to do
- Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the enCVE-2017-1002005 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query.
- Affected
- 1.5 to 1.5
- What to do
- Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of aCVE-2017-1002004 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query.
- Affected
- 1.5 to 1.5
- What to do
- Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Oct 10, 2016Reflected XSS in wordpress plugin heat-trackr v1.0CVE-2016-1000136 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin heat-trackr v1.0
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Dec 2, 2014Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites andCVE-2014-8754 · WordPress plugins & themes · reported by MITREMedium 5.8
Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the out parameter.
- Product
- Ad-Manager
- Affected
- 1.1.2 to 1.1.2
- What to do
- Affects 1.1.2 to 1.1.2. Update Ad-Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 27, 2014SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress alCVE-2014-1854 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
- Affected
- up to 3.9.5
- What to do
- Affects up to 3.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecunia.comadrotateplugin.com
Jan 20, 2014wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass CVE-2010-5293 · WordPress plugins & themes · reported by MITREMedium 5.8
wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam restrictions via a crafted URL, as demonstrated by a URL that triggers a substring match.
- Fixed in
- 3.0.2
- What to do
- Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Dec 7, 2010the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2: SQL injectionCVE-2010-4257 · WordPress plugins & themes · reported by Red HatMedium 6
SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.
- Product
- the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2
- Fixed in
- 3.0.2
- What to do
- Update the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 to 3.0.2 or newer.
Full record and what to do →NVD recordblog.sjinks.probugs.debian.org
Oct 23, 2009wp-trackback.php in WordPress before 2.8.5: Algorithmic complexityCVE-2009-3622 · WordPress plugins & themes · reported by Red HatMedium 4.3
Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8" substrings, related to the mb_convert_encoding function in PHP.
- Product
- wp-trackback.php in WordPress before 2.8.5
- Fixed in
- 2.8.5
- What to do
- Update wp-trackback.php in WordPress before 2.8.5 to 2.8.5 or newer.
Full record and what to do →NVD recordcodes.zerial.orgmarc.info
May 12, 2008wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypasCVE-2008-2146 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.
- Fixed in
- 2.2.3
- What to do
- Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD recordosvdb.orgtrac.wordpress.org
Jan 12, 2007wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphCVE-2007-0233 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
May 20, 2005wp-trackback.php in Wordpress 1.5 and earlier: SQL injectionCVE-2005-1687 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-trackback.php in Wordpress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the tb_id parameter.
- Product
- wp-trackback.php in Wordpress 1.5 and earlier
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update wp-trackback.php in Wordpress 1.5 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbugs.gentoo.orgmarc.info
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.