Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,202 results · page 41 of 45
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and rCVE-2021-24164 · WordPress plugins & themes · reported by WPScanMedium 4.3
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.4.34.1
- What to do
- Update Ninja Forms Contact Form to 3.4.34.1 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore makinCVE-2021-24163 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
- Fixed in
- 3.4.34
- What to do
- Update the plugin to 3.4.34 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extractCVE-2021-24160 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.
- Fixed in
- 4.0.4
- What to do
- Update the plugin to 4.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Mar 18, 2021Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitraryCVE-2021-24144 · WordPress plugins & themes · reported by WPScanHigh 7.8
Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files.
- Fixed in
- 1.2.5.6
- What to do
- Update the plugin to 1.2.5.6 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site ScriptinCVE-2021-24134 · WordPress plugins & themes · reported by WPScanMedium 4.8
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
- Product
- Constant Contact Forms
- Fixed in
- 1.8.8
- What to do
- Update Constant Contact Forms to 1.8.8 or newer.
Mar 18, 2021Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administCVE-2021-24133 · WordPress plugins & themes · reported by WPScanMedium 4.3
Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account.
- Product
- ActiveCampaign
- Fixed in
- 8.0.2
- What to do
- Update ActiveCampaign to 8.0.2 or newer.
Mar 18, 2021The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, CVE-2021-24132 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks.
- Fixed in
- 1.2.36
- What to do
- Update the plugin to 1.2.36 or newer.
Mar 18, 2021Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitCVE-2021-24125 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitting a filter request as a high privilege user (admin+)
- Product
- Contact Form Submissions
- Fixed in
- 1.7.1
- What to do
- Update Contact Form Submissions to 1.7.1 or newer.
Feb 7, 2021wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.CVE-2021-26754 · WordPress plugins & themes · reported by MITRECritical 9.8
wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.
- Fixed in
- 3.4.1
- What to do
- Update the plugin to 3.4.1 or newer.
Full record and what to do →NVD recordn4nj0.github.iowordpress.org
Jan 12, 2021The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.CVE-2021-3133 · WordPress plugins & themes · reported by MITREMedium 6.5
The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.
- Product
- Elementor Contact Form DB
- Fixed in
- 1.6
- What to do
- Update Elementor Contact Form DB to 1.6 or newer.
Full record and what to do →NVD recordadvisory.checkmarx.netplugins.trac.wordpress.org
Dec 17, 2020The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contaCVE-2020-35489 · WordPress plugins & themes · reported by MITRECritical 10
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
- Product
- contact-form-7 (aka Contact Form 7)
- Fixed in
- 5.3.2
- What to do
- Update contact-form-7 (aka Contact Form 7) to 5.3.2 or newer.
Full record and what to do →NVD recordcontactform7.comwordpress.org
Sep 14, 2020Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attackeCVE-2020-25379 · WordPress plugins & themes · reported by MITREHigh 8.8
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query.
- Affected
- 0.8 to 0.8
- What to do
- Affects 0.8 to 0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Aug 31, 2020The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.CVE-2020-20627 · WordPress plugins & themes · reported by MITREMedium 5.3
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
- Product
- includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Aug 26, 2020An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress.CVE-2020-11497 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step.
- Affected
- 2.1.0 to 2.1.0
- What to do
- Affects 2.1.0 to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 21, 2020Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature.CVE-2020-20634 · WordPress plugins & themes · reported by MITREMedium 6.5
Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog.
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 8, 2020The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting sCVE-2020-12800 · WordPress plugins & themes · reported by MITRECritical 9.8
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.
- Product
- drag-and-drop-multiple-file-upload-contact-form-7
- Fixed in
- 1.3.3.3
- What to do
- Update drag-and-drop-multiple-file-upload-contact-form-7 to 1.3.3.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Apr 22, 2020The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions.CVE-2020-12076 · WordPress plugins & themes · reported by MITREHigh 8.8
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.
- Product
- data-tables-generator-by-supsystic
- Fixed in
- 1.9.92
- What to do
- Update data-tables-generator-by-supsystic to 1.9.92 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Apr 22, 2020The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.CVE-2020-12075 · WordPress plugins & themes · reported by MITREHigh 8.8
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.
- Product
- data-tables-generator-by-supsystic
- Fixed in
- 1.9.92
- What to do
- Update data-tables-generator-by-supsystic to 1.9.92 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Apr 22, 2020The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.CVE-2020-12073 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.
- Product
- responsive-add-ons
- Fixed in
- 2.2.7
- What to do
- Update responsive-add-ons to 2.2.7 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Apr 7, 2020Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScrCVE-2020-11516 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
- Product
- Stored XSS in the Contact Form 7 Datepicker
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Stored XSS in the Contact Form 7 Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Mar 24, 2020A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.CVE-2020-10385 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
- Product
- A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite)
- Fixed in
- 1.5.9
- What to do
- Update A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) to 1.5.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Feb 5, 2020The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF.CVE-2020-8658 · WordPress plugins & themes · reported by MITREHigh 8.8
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.
- Product
- BestWebSoft Htaccess
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update BestWebSoft Htaccess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Feb 3, 2020Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.CVE-2020-8549 · WordPress plugins & themes · reported by MITREMedium 6.1
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
- Product
- Stored XSS in the Strong Testimonials
- Fixed in
- 2.40.1
- What to do
- Update Stored XSS in the Strong Testimonials to 2.40.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 23, 2020The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSSCVE-2014-7238 · WordPress plugins & themes · reported by MITREMedium 6.1
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
- Affected
- 1.0 to 2.4
- What to do
- Affects 1.0 to 2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Dec 27, 2019Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6CVE-2014-4536 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.
- Fixed in
- 1.5.6
- What to do
- Update the plugin to 1.5.6 or newer.
Full record and what to do →NVD recordcodevigilant.comwordpress.org
Dec 4, 2019The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanCVE-2019-19133 · WordPress plugins & themes · reported by MITREMedium 6.1
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.
- Product
- CSS Hero
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update CSS Hero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 26, 2019The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS.CVE-2015-9539 · WordPress plugins & themes · reported by MITREMedium 6.1
The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS.
- Product
- Fast Secure Contact Form
- Fixed in
- 4.0.38
- What to do
- Update Fast Secure Contact Form to 4.0.38 or newer.
Full record and what to do →NVD recordcybersecurityworks.comgithub.com
Oct 10, 2019The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1CVE-2015-9479 · WordPress plugins & themes · reported by MITRECritical 9.8
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
- Product
- ACF-Frontend-Display
- Affected
- up to 2015-07-03
- What to do
- Affects up to 2015-07-03. Update ACF-Frontend-Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 10, 2019The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.CVE-2015-9468 · WordPress plugins & themes · reported by MITREMedium 6.1
The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.
- Affected
- 0.4.5 to 0.4.5
- What to do
- Affects 0.4.5 to 0.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2019The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.CVE-2019-17072 · WordPress plugins & themes · reported by MITRECritical 9.8
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
- Affected
- 1.0.9 to 1.0.9
- What to do
- Affects 1.0.9 to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comwordpress.org
Oct 7, 2019The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbCVE-2015-9456 · WordPress plugins & themes · reported by MITREMedium 6.5
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.
- Product
- orbisius-child-theme-creator
- Fixed in
- 1.2.8
- What to do
- Update orbisius-child-theme-creator to 1.2.8 or newer.
Oct 7, 2019The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parametCVE-2015-9455 · WordPress plugins & themes · reported by MITREHigh 8.1
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
- Product
- buddypress-activity-plus
- Fixed in
- 1.6.2
- What to do
- Update buddypress-activity-plus to 1.6.2 or newer.
Full record and what to do →NVD recordsecurity.dxw.comwordpress.org
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameCVE-2015-9451 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
- Product
- plugmatter-optin-feature-box-lite
- Fixed in
- 2.0.14
- What to do
- Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.CVE-2015-9450 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
- Product
- plugmatter-optin-feature-box-lite
- Fixed in
- 2.0.14
- What to do
- Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.CVE-2015-9445 · WordPress plugins & themes · reported by MITREHigh 8.8
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
- Product
- unite-gallery-lite
- Fixed in
- 1.5
- What to do
- Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 25, 2019The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameterCVE-2015-9438 · WordPress plugins & themes · reported by MITREMedium 5.4
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
- Product
- display-widgets
- Fixed in
- 2.04
- What to do
- Update display-widgets to 2.04 or newer.
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.CVE-2015-9436 · WordPress plugins & themes · reported by MITREMedium 5.4
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.
- Product
- dynamic-widgets
- Fixed in
- 1.5.11
- What to do
- Update dynamic-widgets to 1.5.11 or newer.
Sep 25, 2019The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.CVE-2015-9426 · WordPress plugins & themes · reported by MITREMedium 4.6
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
- Product
- manual-image-crop
- Fixed in
- 1.11
- What to do
- Update manual-image-crop to 1.11 or newer.
Sep 25, 2019The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGCVE-2015-9423 · WordPress plugins & themes · reported by MITREMedium 5.4
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters.
- Product
- PlugNedit Adaptive Editor
- Fixed in
- 6.2.0
- What to do
- Update PlugNedit Adaptive Editor to 6.2.0 or newer.
Sep 25, 2019The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_diaCVE-2015-9422 · WordPress plugins & themes · reported by MITREMedium 6.5
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters.
- Product
- PlugNedit Adaptive Editor
- Fixed in
- 6.2.0
- What to do
- Update PlugNedit Adaptive Editor to 6.2.0 or newer.
Sep 25, 2019The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.CVE-2015-9421 · WordPress plugins & themes · reported by MITREMedium 6.5
The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
- Product
- olevmedia-shortcodes
- Fixed in
- 1.1.9
- What to do
- Update olevmedia-shortcodes to 1.1.9 or newer.
Sep 25, 2019The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.CVE-2015-9420 · WordPress plugins & themes · reported by MITREMedium 6.1
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
- Product
- soundcloud-is-gold
- Fixed in
- 2.3.2
- What to do
- Update soundcloud-is-gold to 2.3.2 or newer.
Sep 20, 2019The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.CVE-2015-9395 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
- Product
- users-ultra
- Fixed in
- 1.5.64
- What to do
- Update users-ultra to 1.5.64 or newer.
Full record and what to do →NVD recordseclists.orgwordpress.org
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.CVE-2015-9394 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
- Product
- users-ultra
- Fixed in
- 1.5.63
- What to do
- Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Sep 16, 2019The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.CVE-2016-10961 · WordPress plugins & themes · reported by MITREMedium 6.1
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.
- Product
- colorway
- Fixed in
- 3.4.2
- What to do
- Update colorway to 3.4.2 or newer.
Full record and what to do →NVD recordsumofpwn.nlwpvulndb.com
Sep 16, 2019The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.CVE-2016-10960 · WordPress plugins & themes · reported by MITREHigh 8.8
The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.
- Product
- wsecure
- Fixed in
- 2.4
- What to do
- Update wsecure to 2.4 or newer.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.CVE-2019-15825 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.CVE-2019-15823 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301CVE-2019-15818 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
- Product
- simple-301-redirects-addon-bulk-uploader
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update simple-301-redirects-addon-bulk-uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Aug 29, 2019The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15771 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- Product
- nd-shortcodes
- Fixed in
- 6.0
- What to do
- Update nd-shortcodes to 6.0 or newer.
Full record and what to do →NVD recordthreatpost.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.