Updated 36 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

420new WordPress flaws this week

399,200entries in the database

24,771 results · page 474 of 496

Jun 12, 2020In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pageCVE-2020-4047 · WordPress plugins & themes · reported by GitHubMedium 6.8
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 12, 2020In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML CVE-2020-4046 · WordPress plugins & themes · reported by GitHubMedium 5.4
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Jun 8, 2020The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting sCVE-2020-12800 · WordPress plugins & themes · reported by MITRECritical 9.8
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.
Product
drag-and-drop-multiple-file-upload-contact-form-7
Fixed in
1.3.3.3
What to do
Update drag-and-drop-multiple-file-upload-contact-form-7 to 1.3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
May 29, 2020The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/CVE-2020-12675 · WordPress plugins & themes · reported by MITREHigh 8.8
The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.
Product
mappress-google-maps-for-wordpress
Fixed in
2.54.6
What to do
Update mappress-google-maps-for-wordpress to 2.54.6 or newer.
Full record and what to do →NVD record blog.alertlogic.com wordpress.org
May 28, 2020An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.CVE-2020-13693 · WordPress plugins & themes · reported by MITRECritical 9.8
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
Product
An unauthenticated privilege-escalation issue exists in the bbPress
Fixed in
2.6.5
What to do
Update An unauthenticated privilege-escalation issue exists in the bbPress to 2.6.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com bbpress.org
May 28, 2020An issue was discovered in the Accordion plugin before 2.2.9 for WordPress.CVE-2020-13644 · WordPress plugins & themes · reported by MITREMedium 5.4
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.
Product
An issue was discovered in the Accordion
Fixed in
2.2.9
What to do
Update An issue was discovered in the Accordion to 2.2.9 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
May 26, 2020The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=foCVE-2020-13487 · WordPress plugins & themes · reported by MITREMedium 4.8
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
Product
bbPress
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bbpress.org codex.bbpress.org
May 16, 2020An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125.CVE-2020-13126 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.
Product
An issue was discovered in the Elementor Pro
Fixed in
2.9.4
What to do
Update An issue was discovered in the Elementor Pro to 2.9.4 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
May 16, 2020An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-CVE-2020-13125 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.
Product
An issue was discovered in the "Ultimate Addons for Elementor
Fixed in
1.24.2
What to do
Update An issue was discovered in the "Ultimate Addons for Elementor to 1.24.2 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
May 13, 2020WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly CVE-2020-12832 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
Fixed in
4.2.8
What to do
Update the plugin to 4.2.8 or newer.
Full record and what to do →NVD record ctulhu.me plugins.trac.wordpress.org
May 13, 2020The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.CVE-2020-12742 · WordPress plugins & themes · reported by MITREMedium 6.1
The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
Product
iubenda-cookie-law-solution
Fixed in
2.3.5
What to do
Update iubenda-cookie-law-solution to 2.3.5 or newer.
Full record and what to do →NVD record github.com wordpress.org
May 8, 2020A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin.CVE-2020-11530 · WordPress plugins & themes · reported by MITRECritical 9.8
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user.
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
May 5, 2020A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress.CVE-2020-8799 · WordPress plugins & themes · reported by MITREMedium 4.8
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website.
Product
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update A Stored XSS vulnerability has been found in the administration page of the WTI Like Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
May 5, 2020Import feature in the wp-advanced-search plugin 3.3.6: Authenticated SQL injectionCVE-2020-12104 · WordPress plugins & themes · reported by MITREHigh 8.8
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
Product
Import feature in the wp-advanced-search plugin 3.3.6
Fixed in
3.3.7
What to do
Update Import feature in the wp-advanced-search plugin 3.3.6 to 3.3.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Apr 30, 2020In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor.CVE-2020-11030 · WordPress plugins & themes · reported by GitHubMedium 6.4
In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com wordpress.org
Apr 30, 2020the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting: In affected versions of WordPress, aCVE-2020-11029 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Product
the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting
What to do
Update the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Apr 30, 2020In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditionsCVE-2020-11028 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Apr 30, 2020In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password.CVE-2020-11027 · WordPress plugins & themes · reported by GitHubMedium 6.1
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com github.com
Apr 30, 2020In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file.CVE-2020-11026 · WordPress plugins & themes · reported by GitHubHigh 8.7
In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Apr 30, 2020the navigation section of Customizer: In affected versions of WordPress, a cross-site scripting (XSS)CVE-2020-11025 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Product
the navigation section of Customizer
What to do
Update the navigation section of Customizer to the newest version.
Full record and what to do →NVD record github.com wordpress.org
Apr 30, 2020LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL InjectionCVE-2020-6010 · WordPress plugins & themes · reported by cve@checkpoint.comHigh 8.8
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
Affected
up to 3.2.6.7
What to do
Affects up to 3.2.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Apr 24, 2020The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request viaCVE-2020-12070 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.
Product
Advanced Woo Search
Affected
up to 1.99
What to do
Affects up to 1.99. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 22, 2020The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leadinCVE-2020-12077 · WordPress plugins & themes · reported by MITREHigh 8.8
The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leading to remote code execution.
Product
mappress-google-maps-for-wordpress
Fixed in
2.53.9
What to do
Update mappress-google-maps-for-wordpress to 2.53.9 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 22, 2020The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions.CVE-2020-12076 · WordPress plugins & themes · reported by MITREHigh 8.8
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.
Product
data-tables-generator-by-supsystic
Fixed in
1.9.92
What to do
Update data-tables-generator-by-supsystic to 1.9.92 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 22, 2020The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.CVE-2020-12075 · WordPress plugins & themes · reported by MITREHigh 8.8
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.
Product
data-tables-generator-by-supsystic
Fixed in
1.9.92
What to do
Update data-tables-generator-by-supsystic to 1.9.92 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 22, 2020The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.CVE-2020-12073 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.
Product
responsive-add-ons
Fixed in
2.2.7
What to do
Update responsive-add-ons to 2.2.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 19, 2020In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gCVE-2020-11928 · WordPress plugins & themes · reported by MITRECritical 9.8
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.
Product
In the media-library-assistant
Fixed in
2.82
What to do
Update In the media-library-assistant to 2.82 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 12, 2020The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.CVE-2020-11732 · WordPress plugins & themes · reported by MITREHigh 7.5
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.
Product
Media Library Assistant
Fixed in
2.82
What to do
Update Media Library Assistant to 2.82 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 7, 2020An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pagesCVE-2020-11508 · WordPress plugins & themes · reported by MITREMedium 5.4
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pages with a malicious page containing arbitrary JavaScript via the wp_ajax_core37_lp_save_page (aka core37_lp_save_page) AJAX action.
Product
An XSS vulnerability in the WP Lead Plus X
Affected
up to 0.98
What to do
Affects up to 0.98. Update An XSS vulnerability in the WP Lead Plus X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScrCVE-2020-11516 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
Product
Stored XSS in the Contact Form 7 Datepicker
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Stored XSS in the Contact Form 7 Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrCVE-2020-11512 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts.
Product
IMPress for IDX Broker
Fixed in
2.6.2
What to do
Update IMPress for IDX Broker to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.CVE-2019-17231 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
Product
includes/theme-functions.php in the OneTone
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.CVE-2019-17230 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
Product
includes/theme-functions.php in the OneTone
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Apr 1, 2020LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.CVE-2020-6009 · WordPress plugins & themes · reported by cve@checkpoint.comCritical 9.8
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.
Fixed in
3.1.6
What to do
Update the plugin to 3.1.6 or newer.
Full record and what to do →NVD record learndash.releasenotes.io learndash.releasenotes.io
Mar 31, 2020LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code executionCVE-2020-6008 · WordPress plugins & themes · reported by cve@checkpoint.comCritical 9.8
LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution
Fixed in
3.37.15
What to do
Update the plugin to 3.37.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 27, 2020The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection.CVE-2020-10817 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
Product
custom-searchable-data-entry-system (aka Custom Searchable Data Entry System)
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avveng.com plugins.trac.wordpress.org
Mar 20, 2020The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.CVE-2019-12498 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.
Product
WP Live Chat Support
Fixed in
8.0.33
What to do
Update WP Live Chat Support to 8.0.33 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2020The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via adminCVE-2020-10195 · WordPress plugins & themes · reported by MITREMedium 6.3
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.
Product
popup-builder
Fixed in
3.64.1
What to do
Update popup-builder to 3.64.1 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Mar 12, 2020XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.CVE-2020-8436 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.
Product
RegistrationMagic
Affected
4.6.0.0 to 4.6.0.0
What to do
Affects 4.6.0.0 to 4.6.0.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record spider-security.co.uk spider-security.co.uk
Mar 12, 2020An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress.CVE-2020-8435 · WordPress plugins & themes · reported by MITREHigh 8.1
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter.
Product
RegistrationMagic
Affected
4.6.0.0 to 4.6.0.0
What to do
Affects 4.6.0.0 to 4.6.0.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record spider-security.co.uk spider-security.co.uk
Mar 9, 2020The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functionCVE-2020-10257 · WordPress plugins & themes · reported by MITRECritical 9.8
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Product
ThemeREX Addons
Fixed in
2020-03-09
What to do
Update ThemeREX Addons to 2020-03-09 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submittCVE-2020-9458 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and chaCVE-2020-9457 · WordPress plugins & themes · reported by MITREHigh 8.8
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their CVE-2020-9456 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of theCVE-2020-9455 · WordPress plugins & themes · reported by MITREMedium 4.3
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator tCVE-2020-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
Product
A CSRF vulnerability in the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update A CSRF vulnerability in the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 4, 2020The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formCVE-2020-9372 · WordPress plugins & themes · reported by MITREHigh 7.8
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
Product
Appointment Booking Calendar
Fixed in
1.3.35
What to do
Update Appointment Booking Calendar to 1.3.35 or newer.
Full record and what to do →NVD record packetstormsecurity.com drive.google.com
Feb 28, 2020The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.CVE-2020-9466 · WordPress plugins & themes · reported by MITREMedium 6.1
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.
Product
Export Users to CSV
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Export Users to CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com getastra.com
Feb 25, 2020The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.CVE-2020-9019 · WordPress plugins & themes · reported by MITREMedium 6.1
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
Affected
5.5.3 to 5.5.3
What to do
Affects 5.5.3 to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.ikiu.ac.ir uploadboy.com
Feb 24, 2020includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multipleCVE-2019-17229 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.
Product
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads)
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.