Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,546 results · page 41 of 51

Jan 23, 2017Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL comCVE-2016-0769 · WordPress plugins & themes · reported by Red HatHigh 8.8
Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
Product
eShop
Affected
6.3.14 to 6.3.14
What to do
Affects 6.3.14 to 6.3.14. Update eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 23, 2017Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web CVE-2016-0765 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter.
Product
eShop
Affected
6.3.14 to 6.3.14
What to do
Affects 6.3.14 to 6.3.14. Update eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 18, 2017the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6: Cross-site request forgery (CSRF)CVE-2016-6897 · WordPress plugins & themes · reported by MITREMedium 6.5
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
Product
the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6
Fixed in
4.6
What to do
Update the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 to 4.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 18, 2017the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3: Directory traversalCVE-2016-6896 · WordPress plugins & themes · reported by MITREHigh 7.1
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.
Product
the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3
What to do
Update the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 to the newest version.
Full record and what to do →NVD record openwall.com securitytracker.com
Jan 18, 2017The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_pluginsCVE-2016-10148 · WordPress plugins & themes · reported by MITREMedium 4.3
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.
Fixed in
4.6
What to do
Update the plugin to 4.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 14, 2017wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier foCVE-2017-5493 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 14, 2017wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com nCVE-2017-5491 · WordPress plugins & themes · reported by MITREMedium 5.3
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 14, 2017the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1: Cross-site scripting (XSS)CVE-2017-5490 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.
Product
the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1
Fixed in
4.7.1
What to do
Update the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 14, 2017Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script CVE-2017-5488 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Jan 14, 2017wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listinCVE-2017-5487 · WordPress plugins & themes · reported by MITREMedium 5.3
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
Fixed in
4.7.1
What to do
Update the plugin to 4.7.1 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 4, 2017Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPCVE-2016-7169 · WordPress plugins & themes · reported by MITREMedium 6.3
Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jan 4, 2017Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackeCVE-2016-7168 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record debian.org openwall.com
Aug 7, 2016the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5: Cross-site request forgery (CSRF)CVE-2016-6635 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.
Product
the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5
Fixed in
4.5
What to do
Update the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 to 4.5 or newer.
Full record and what to do →NVD record codex.wordpress.org debian.org
Jun 29, 2016the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3: Cross-site scripting (XSS)CVE-2016-5834 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
Product
the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3
Fixed in
4.5.3
What to do
Update the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 29, 2016the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3: Cross-site scripting (XSS)CVE-2016-5833 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
Product
the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3
Fixed in
4.5.3
What to do
Update the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 to 4.5.3 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jun 25, 2016The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code vCVE-2016-4825 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.6
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.
Product
Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
May 21, 2016The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attackCVE-2016-2222 · WordPress plugins & themes · reported by security@debian.orgHigh 8.6
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
Fixed in
4.4.2
What to do
Update the plugin to 4.4.2 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 21, 2016the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2: Open redirectCVE-2016-2221 · WordPress plugins & themes · reported by security@debian.orgHigh 7.4
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
Product
the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2
Fixed in
4.4.2
What to do
Update the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 to 4.4.2 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 21, 2016Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web sCVE-2016-1564 · WordPress plugins & themes · reported by security@debian.orgMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.
Fixed in
4.4.1
What to do
Update the plugin to 4.4.1 or newer.
Full record and what to do →NVD record twitter.com debian.org
May 21, 2016wp-includes/wp-db.php in WordPress before 4.2.2: Cross-site scripting (XSS)CVE-2015-8834 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.
Product
wp-includes/wp-db.php in WordPress before 4.2.2
Fixed in
4.2.2
What to do
Update wp-includes/wp-db.php in WordPress before 4.2.2 to 4.2.2 or newer.
Full record and what to do →NVD record debian.org codex.wordpress.org
May 21, 2016The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypassCVE-2015-5715 · WordPress plugins & themes · reported by MITREMedium 4.3
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
Fixed in
4.3.1
What to do
Update the plugin to 4.3.1 or newer.
Full record and what to do →NVD record debian.org debian.org
May 14, 2016The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST reqCVE-2016-1209 · WordPress plugins & themes · reported by vultures@jpcert.or.jpCritical 9.8
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
Product
Ninja Forms
Fixed in
2.9.42.1
What to do
Update Ninja Forms to 2.9.42.1 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jan 12, 2016Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary fiCVE-2015-5471 · WordPress plugins & themes · reported by MITREMedium 5.3
Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Product
Swim Team
Affected
1.44.10777 to 1.44.10777
What to do
Affects 1.44.10777 to 1.44.10777. Update Swim Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record michaelwalsh.org packetstormsecurity.com
Jan 12, 2016Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary filesCVE-2015-4703 · WordPress plugins & themes · reported by MITREMedium 5.3
Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter.
Product
WordPress Rename
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update WordPress Rename to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Jan 8, 2016Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via aCVE-2015-4694 · WordPress plugins & themes · reported by MITREHigh 8.6
Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.
Product
Directory traversal vulnerability in download.php in the Zip Attachments
Fixed in
1.5.1
What to do
Update Directory traversal vulnerability in download.php in the Zip Attachments to 1.5.1 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Dec 29, 2015Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrarCVE-2015-7791 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.3
Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) search[column] or (2) switch parameter.
Product
Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart
Fixed in
1.5.3
What to do
Update Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart to 1.5.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Dec 17, 2015lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of prevCVE-2015-7527 · WordPress plugins & themes · reported by Red HatHigh 7.5
lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of preview image" and possibly other input fields in the "Video Gallery Settings" page.
Product
Cool Video Gallery
Affected
1.9 to 1.9
What to do
Affects 1.9 to 1.9. Update Cool Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Nov 9, 2015the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5734 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.
Product
the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5732 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.
Product
the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015wp-admin/post.php in WordPress before 4.2.4: Cross-site request forgery (CSRF)CVE-2015-5731 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action.
Product
wp-admin/post.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update wp-admin/post.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgetCVE-2015-5730 · WordPress plugins & themes · reported by MITREMedium 5
The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.
Fixed in
4.2.4
What to do
Update the plugin to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 9, 2015the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4: SQL injectionCVE-2015-2213 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
Product
the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Nov 2, 2015Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL comCVE-2015-5308 · WordPress plugins & themes · reported by Red HatHigh 7.5
Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.
Product
wp-championship
Affected
5.8 to 5.8
What to do
Affects 5.8 to 5.8. Update wp-championship to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org wpvulndb.com
Oct 16, 2015Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitrary files via a full CVE-2015-7683 · WordPress plugins & themes · reported by MITREMedium 4
Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitrary files via a full pathname in the url parameter to AjaxProxy.php.
Product
Absolute path traversal vulnerability in Font.php in the Font
Fixed in
7.5.1
What to do
Update Absolute path traversal vulnerability in Font.php in the Font to 7.5.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 16, 2015Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to exCVE-2015-7682 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register
Fixed in
2.0.19
What to do
Update Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register to 2.0.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 16, 2015Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to injeCVE-2015-7377 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
Product
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register
Fixed in
2.0.19
What to do
Update Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register to 2.0.19 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 29, 2015Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.CVE-2015-7320 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Fixed in
1.1.8
What to do
Update the plugin to 1.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 29, 2015SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows rCVE-2015-7319 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
Product
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar
Fixed in
1.1.8
What to do
Update SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar to 1.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 28, 2015Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remoteCVE-2015-7386 · WordPress plugins & themes · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.
Product
Gallery - Photo Albums - Portfolio
Affected
1.3.47 to 1.3.47
What to do
Affects 1.3.47 to 1.3.47. Update Gallery - Photo Albums - Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 17, 2015Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to executCVE-2015-7235 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
Product
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar
Fixed in
1.1.7
What to do
Update Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar to 1.1.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 16, 2015Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allCVE-2015-6829 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP header.
Fixed in
2.0.1
What to do
Update the plugin to 2.0.1 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Sep 16, 2015The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloCVE-2015-6828 · WordPress plugins & themes · reported by MITREMedium 6.8
The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by modifying the client-server data stream. NOTE: some of these details are obtained from third party information.
Product
SecureMoz Security Audit
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update SecureMoz Security Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Sep 15, 2015Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via CVE-2015-5472 · WordPress plugins & themes · reported by MITREHigh 7.8
Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Product
Absolute path traversal vulnerability in lib/download.php in the IBS Mappro
Fixed in
1.0
What to do
Update Absolute path traversal vulnerability in lib/download.php in the IBS Mappro to 1.0 or newer.
Full record and what to do →NVD record vapid.dhs.org wordpress.org
Sep 11, 2015Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script CVE-2015-6920 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Product
sourceAFRICA
Affected
0.1.3 to 0.1.3
What to do
Affects 0.1.3 to 0.1.3. Update sourceAFRICA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Sep 1, 2015Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitraCVE-2015-2807 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Product
Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud
Fixed in
0.1.1
What to do
Update Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud to 0.1.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 31, 2015Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators toCVE-2015-6535 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
Product
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed
Fixed in
3.3.3
What to do
Update Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed to 3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Aug 18, 2015Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbCVE-2015-5481 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Product
Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments
Fixed in
2.3
What to do
Update Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 18, 2015Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploCVE-2015-5681 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 18, 2015Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands CVE-2015-5599 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 18, 2015Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 forCVE-2015-5485 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php.
Fixed in
3.10.2
What to do
Update the plugin to 3.10.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.