Updated 28 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

420new WordPress flaws this week

399,200entries in the database

24,771 results · page 473 of 496

Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.CVE-2020-36175 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
Product
Ninja Forms
Fixed in
3.4.27.1
What to do
Update Ninja Forms to 3.4.27.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.CVE-2020-36174 · WordPress plugins & themes · reported by MITREMedium 6.5
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
Product
Ninja Forms
Fixed in
3.4.27.1
What to do
Update Ninja Forms to 3.4.27.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 6, 2021The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.CVE-2020-36173 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
Product
Ninja Forms
Fixed in
3.4.28
What to do
Update Ninja Forms to 3.4.28 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles.CVE-2020-36157 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a WordPress capability (or any custom Ultimate Member role) and effectively be granted those privileges.
Product
An issue was discovered in the Ultimate Member
Fixed in
2.1.12
What to do
Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD record wordpress.org wpscan.com
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update.CVE-2020-36156 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.
Product
An issue was discovered in the Ultimate Member
Fixed in
2.1.12
What to do
Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD record wordpress.org wpscan.com
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.CVE-2020-36155 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user meta that defines a user's role. During the registration process, submitted registration details were passed to the update_profile function, and any metadata was accepted, e.g., wp_capabilities[administrator] for Administrator access.
Product
An issue was discovered in the Ultimate Member
Fixed in
2.1.12
What to do
Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD record wordpress.org wpscan.com
Dec 31, 2020PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objecCVE-2020-35939 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.
Product
PHP Object injection vulnerabilities in the Team Showcase
Fixed in
1.22.16
What to do
Update PHP Object injection vulnerabilities in the Team Showcase to 1.22.16 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects duCVE-2020-35938 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.
Product
PHP Object injection vulnerabilities in the Post Grid
Fixed in
2.0.73
What to do
Update PHP Object injection vulnerabilities in the Post Grid to 2.0.73 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple RCVE-2020-35935 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)
Product
Advanced Access Manager
Fixed in
6.6.2
What to do
Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers)CVE-2020-35932 · WordPress plugins & themes · reported by MITREHigh 7.5
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.
Product
Insecure Deserialization in the Newsletter
Fixed in
6.8.2
What to do
Update Insecure Deserialization in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 21, 2020The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS.CVE-2020-35589 · WordPress plugins & themes · reported by MITREMedium 5.4
The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.
Product
limit-login-attempts-reloaded
Fixed in
2.17.4
What to do
Update limit-login-attempts-reloaded to 2.17.4 or newer.
Full record and what to do →NVD record n4nj0.github.io wordpress.org
Dec 17, 2020The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contaCVE-2020-35489 · WordPress plugins & themes · reported by MITRECritical 10
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
Product
contact-form-7 (aka Contact Form 7)
Fixed in
5.3.2
What to do
Update contact-form-7 (aka Contact Form 7) to 5.3.2 or newer.
Full record and what to do →NVD record contactform7.com wordpress.org
Dec 14, 2020A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have conviCVE-2020-29304 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim is proceeding through the file import workflow.
Fixed in
1.3.46
What to do
Update the plugin to 1.3.46 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via tCVE-2020-14207 · WordPress plugins & themes · reported by MITREMedium 5.3
The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via the divelog.php filter_diver parameter.
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org hooperlabs.xyz
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).CVE-2020-14206 · WordPress plugins & themes · reported by MITREMedium 6.1
The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org hooperlabs.xyz
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks.CVE-2020-14205 · WordPress plugins & themes · reported by MITREMedium 5.3
The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks. An attacker may leverage this issue to manipulate the integrity of dive logs.
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org hooperlabs.xyz
Nov 15, 2020The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for thCVE-2020-28650 · WordPress plugins & themes · reported by MITREMedium 6.4
The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles.
Product
WPBakery
Fixed in
6.4.1
What to do
Update WPBakery to 6.4.1 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Nov 12, 2020Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which: An unauthenticated SQL InjectionCVE-2020-27481 · WordPress plugins & themes · reported by MITRECritical 9.8
An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization.
Product
Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com gist.github.com
Nov 7, 2020The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize.CVE-2020-28339 · WordPress plugins & themes · reported by MITREHigh 7.5
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain.
Product
usc-e-shop (aka Collne Welcart e-Commerce)
Fixed in
1.9.36
What to do
Update usc-e-shop (aka Collne Welcart e-Commerce) to 1.9.36 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 4, 2020Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.CVE-2020-22277 · WordPress plugins & themes · reported by MITREHigh 8
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Affected
up to 1.15.5.11
What to do
Affects up to 1.15.5.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.ikiu.ac.ir mega.nz
Nov 4, 2020WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.CVE-2020-22276 · WordPress plugins & themes · reported by MITRECritical 9.8
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.
Affected
1.4.7 to 1.4.7
What to do
Affects 1.4.7 to 1.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record uploadboy.com cert.ikiu.ac.ir
Nov 4, 2020Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands.CVE-2020-22275 · WordPress plugins & themes · reported by MITREHigh 8.8
Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable.
Affected
2.0.6 to 2.0.6
What to do
Affects 2.0.6 to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record uploadboy.com cert.ikiu.ac.ir
Nov 2, 2020is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is CVE-2020-28039 · WordPress plugins & themes · reported by MITRECritical 9.1
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record github.com lists.debian.org
Nov 2, 2020is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attaCVE-2020-28037 · WordPress plugins & themes · reported by MITRECritical 9.8
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record github.com lists.debian.org
Nov 2, 2020WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.CVE-2020-28032 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record github.com lists.debian.org
Oct 27, 2020search functionality of the Greenmart theme 2.4.2: XSSCVE-2020-16140 · WordPress plugins & themes · reported by MITREMedium 6.1
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.
Product
search functionality of the Greenmart theme 2.4.2
Affected
2.4.2 to 2.4.2
What to do
Affects 2.4.2 to 2.4.2. Update search functionality of the Greenmart theme 2.4.2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com cybersecurityworks.com
Oct 21, 2020The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.CVE-2020-27615 · WordPress plugins & themes · reported by MITRECritical 9.8
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
Product
Loginizer
Fixed in
1.6.4
What to do
Update Loginizer to 1.6.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpdeeply.com
Oct 21, 2020Simple Download Monitor 3.8.8 and earlier: SQL injectionCVE-2020-5651 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL.
Product
Simple Download Monitor 3.8.8 and earlier
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update Simple Download Monitor 3.8.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Oct 14, 2020Live Chat - Live support version 3.1.0 and earlier: Cross-site request forgery (CSRF)CVE-2020-5642 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Live Chat - Live support version 3.1.0 and earlier
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Live Chat - Live support version 3.1.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Sep 30, 2020There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needCVE-2020-21524 · WordPress plugins & themes · reported by MITRECritical 9.1
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Sep 16, 2020A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions.CVE-2020-20406 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Sep 10, 2020Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticCVE-2020-5780 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.3
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.
Fixed in
4.5.6
What to do
Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Sep 9, 2020WordPress File Manager Plugin Remote Code Execution VulnerabilityCVE-2020-25213 · WordPress plugins & themes · reported by MITREExploitedCritical 10
WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Product
File Manager Plugin
Fixed in
6.9
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Aug 31, 2020The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.CVE-2020-20627 · WordPress plugins & themes · reported by MITREMedium 5.3
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
Product
includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Aug 31, 2020Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.CVE-2020-20625 · WordPress plugins & themes · reported by MITREHigh 7.5
Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Aug 26, 2020An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress.CVE-2020-11497 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step.
Affected
2.1.0 to 2.1.0
What to do
Affects 2.1.0 to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 24, 2020A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any tCVE-2020-24186 · WordPress plugins & themes · reported by MITRECritical 10
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
Product
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0
Affected
up to 7.0.4
What to do
Affects up to 7.0.4. Update A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 16, 2020php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameCVE-2016-11085 · WordPress plugins & themes · reported by MITREMedium 6.5
php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.
Product
php/qmn_options_questions_tab.php in the quiz-master-next
Fixed in
4.7.9
What to do
Update php/qmn_options_questions_tab.php in the quiz-master-next to 4.7.9 or newer.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Jul 27, 2020Social Sharing Plugin versions prior to 1.2.10: Cross-site request forgery (CSRF)CVE-2020-5611 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Social Sharing Plugin versions prior to 1.2.10
Fixed in
1.2.10
What to do
Update Social Sharing Plugin versions prior to 1.2.10 to 1.2.10 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 23, 2020Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing DetailCVE-2019-18834 · WordPress plugins & themes · reported by MITREMedium 6.1
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.
Product
Persistent XSS in the WooCommerce Subscriptions
Fixed in
2.6.3
What to do
Update Persistent XSS in the WooCommerce Subscriptions to 2.6.3 or newer.
Full record and what to do →NVD record woocommerce.com precursorsecurity.com
Jul 17, 2020Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 alloCVE-2020-5768 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 4.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields.
Affected
4.4.8 to 4.4.8
What to do
Affects 4.4.8 to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Jul 13, 2020Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a reCVE-2020-5766 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record tenable.com tenable.com
Jul 9, 2020In TimelineJS before version 3.7.0, some user data renders as HTML.CVE-2020-15092 · WordPress plugins & themes · reported by GitHubHigh 7.2
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most TimelineJS users configure their timeline with a Google Sheets document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if they grant public write access to the document. Some TimelineJS users configure their timeline with a JSON document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if write access to the system hosting that document is otherwise compromised. Version 3.7.0 of TimelineJS addresses this in two ways. For content which is intended to support limited HTML markup for styling and linking, that content is "sanitized" before being added to the DOM. For content intended for simple text display, all markup is stripped. Very few users
Product
code. Some users of TimelineJS use it as a part of a
What to do
Update code. Some users of TimelineJS use it as a part of a to the newest version.
Full record and what to do →NVD record github.com knightlab.northwestern.edu
Jul 2, 2020The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.CVE-2020-14092 · WordPress plugins & themes · reported by MITRECritical 9.8
The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.
Product
CodePeople Payment Form for PayPal Pro
Fixed in
1.1.65
What to do
Update CodePeople Payment Form for PayPal Pro to 1.1.65 or newer.
Full record and what to do →NVD record wordpress.dwbooster.com wordpress.org
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.CVE-2020-15364 · WordPress plugins & themes · reported by MITREMedium 6.1
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
Product
Nexos
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.CVE-2020-15363 · WordPress plugins & themes · reported by MITRECritical 9.8
The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.
Product
Nexos
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 18, 2020A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order paCVE-2020-13640 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)
Product
gVectors wpDiscuz
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update gVectors wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com plugins.trac.wordpress.org
Jun 12, 2020In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved.CVE-2020-4050 · WordPress plugins & themes · reported by GitHubLow 3.5
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 12, 2020In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-adCVE-2020-4049 · WordPress plugins & themes · reported by GitHubLow 2.4
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 12, 2020In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintendCVE-2020-4048 · WordPress plugins & themes · reported by GitHubMedium 5.7
In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.