Updated 48 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

420new WordPress flaws this week

399,200entries in the database

24,771 results · page 475 of 496

Feb 24, 2020includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unautCVE-2019-17228 · WordPress plugins & themes · reported by MITREMedium 6.5
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
Product
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads)
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Feb 18, 2020Easy Property Listings versions prior to 3.4: Cross-site request forgery (CSRF)CVE-2020-5530 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Easy Property Listings versions prior to 3.4
Fixed in
3.4
What to do
Update Easy Property Listings versions prior to 3.4 to 3.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Feb 17, 2020The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.CVE-2020-9043 · WordPress plugins & themes · reported by MITREHigh 8.8
The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.
Product
wpCentral
Fixed in
1.5.1
What to do
Update wpCentral to 1.5.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 17, 2020Popup Builder plugin 2.2.8 through 2.6.7.6: SQL injection (in the sgImportPopups function in sg_popup_ajaxCVE-2020-9006 · WordPress plugins & themes · reported by MITRECritical 9.8
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)
Product
Popup Builder plugin 2.2.8 through 2.6.7.6
Affected
up to 2.6.7.6
What to do
Affects up to 2.6.7.6. Update Popup Builder plugin 2.2.8 through 2.6.7.6 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 13, 2020Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow CVE-2013-1401 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll.
Product
editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll
Affected
34.05 to 34.05
What to do
Affects 34.05 to 34.05. Update editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Feb 13, 2020Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the polliCVE-2013-1400 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Feb 12, 2020WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution VulnerabilityCVE-2013-2010 · WordPress plugins & themes · reported by Red HatCritical 9.8
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Feb 11, 2020participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the aCVE-2020-8596 · WordPress plugins & themes · reported by MITREHigh 7.5
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
Product
Participants Database
Affected
up to 1.9.5.5
What to do
Affects up to 1.9.5.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.impenetrable.tech wpvulndb.com
Feb 10, 2020WordPress plugin wp-cleanfix has Remote Code ExecutionCVE-2013-2109 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress plugin wp-cleanfix has Remote Code Execution
Affected
1.4 to 1.4
What to do
Affects 1.4 to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com exchange.xforce.ibmcloud.com
Feb 8, 2020Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SCVE-2015-2062 · WordPress plugins & themes · reported by MITREHigh 7.2
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts or edit_cat action in the sliders_huge_it_slider page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image)
Fixed in
2.7.0
What to do
Update Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) to 2.7.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Feb 8, 2020Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions CreaCVE-2014-8739 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Fixed in
1.0.0
What to do
Update the plugin to 1.0.0 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Feb 7, 2020WordPress WP Super Cache Plugin 1.2 has Remote PHP Code ExecutionCVE-2013-2009 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Feb 6, 2020The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.CVE-2020-8772 · WordPress plugins & themes · reported by MITRECritical 9.8
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.
Product
InfiniteWP Client
Fixed in
1.9.4.5
What to do
Update InfiniteWP Client to 1.9.4.5 or newer.
Full record and what to do →NVD record wpvulndb.com webarxsecurity.com
Feb 6, 2020The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass.CVE-2020-8771 · WordPress plugins & themes · reported by MITRECritical 9.8
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
Product
Time Capsule
Fixed in
1.21.16
What to do
Update Time Capsule to 1.21.16 or newer.
Full record and what to do →NVD record wpvulndb.com webarxsecurity.com
Feb 5, 2020The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF.CVE-2020-8658 · WordPress plugins & themes · reported by MITREHigh 8.8
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.
Product
BestWebSoft Htaccess
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update BestWebSoft Htaccess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Feb 3, 2020Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.CVE-2020-8549 · WordPress plugins & themes · reported by MITREMedium 6.1
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
Product
Stored XSS in the Strong Testimonials
Fixed in
2.40.1
What to do
Update Stored XSS in the Strong Testimonials to 2.40.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jan 30, 2020XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter.CVE-2020-8498 · WordPress plugins & themes · reported by MITREMedium 5.4
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
Product
XSS exists in the shortcode functionality of the GistPress
Fixed in
3.0.2
What to do
Update XSS exists in the shortcode functionality of the GistPress to 3.0.2 or newer.
Full record and what to do →NVD record github.com github.com
Jan 28, 2020Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication ofCVE-2015-5483 · WordPress plugins & themes · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.
Product
Private Only
Affected
3.5.1 to 3.5.1
What to do
Affects 3.5.1 to 3.5.1. Update Private Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 27, 2020WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerabilityCVE-2013-4462 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 22, 2020The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.CVE-2020-7109 · WordPress plugins & themes · reported by MITRECritical 9.8
The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.
Product
Elementor Page Builder
Fixed in
2.8.4
What to do
Update Elementor Page Builder to 2.8.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 21, 2020The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.CVE-2020-7239 · WordPress plugins & themes · reported by MITREMedium 6.1
The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.
Product
conversation-watson
Fixed in
0.8.21
What to do
Update conversation-watson to 0.8.21 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 17, 2020The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.CVE-2020-7104 · WordPress plugins & themes · reported by MITREMedium 6.1
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.
Affected
1.1.8.1 to 1.1.8.1
What to do
Affects 1.1.8.1 to 1.1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Jan 16, 2020The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-aCVE-2020-7047 · WordPress plugins & themes · reported by MITREHigh 8.8
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table.
Affected
up to 3.1
What to do
Affects up to 3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 9, 2020The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.CVE-2019-20180 · WordPress plugins & themes · reported by MITREMedium 6.8
The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com wordpress.org
Jan 8, 2020A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user infoCVE-2019-20360 · WordPress plugins & themes · reported by MITREHigh 7.5
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.
Fixed in
2.5.5
What to do
Update the plugin to 2.5.5 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Jan 2, 2020The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an emailCVE-2019-20203 · WordPress plugins & themes · reported by MITREMedium 5.3
The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.
Product
Postie
Affected
up to 1.9.40
What to do
Affects up to 1.9.40. Update Postie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com postieplugin.com
Dec 27, 2019Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6CVE-2014-4536 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.
Fixed in
1.5.6
What to do
Update the plugin to 1.5.6 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org
Dec 27, 2019In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scCVE-2019-20042 · WordPress plugins & themes · reported by MITREMedium 6.1
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.ripstech.com core.trac.wordpress.org
Dec 27, 2019wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization,CVE-2019-20041 · WordPress plugins & themes · reported by MITRECritical 9.8
wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript&colon; substring.
Fixed in
5.3.1
What to do
Update the plugin to 5.3.1 or newer.
Full record and what to do →NVD record github.com lists.debian.org
Dec 26, 2019WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code.CVE-2013-2011 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009.
Fixed in
1.3.2
What to do
Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Dec 26, 2019the wpDataTables Lite Version 2.0.11 and earlier: SQL injectionCVE-2019-6012 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.2
SQL injection vulnerability in the wpDataTables Lite Version 2.0.11 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Product
the wpDataTables Lite Version 2.0.11 and earlier
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update the wpDataTables Lite Version 2.0.11 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 26, 2019wpDataTables Lite Version 2.0.11 and earlier: Cross-site scriptingCVE-2019-6011 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in wpDataTables Lite Version 2.0.11 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
wpDataTables Lite Version 2.0.11 and earlier
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update wpDataTables Lite Version 2.0.11 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.CVE-2019-19985 · WordPress plugins & themes · reported by MITREMedium 5.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Dec 25, 2019In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered.CVE-2019-19983 · WordPress plugins & themes · reported by MITREMedium 4.3
In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.
Fixed in
2.7.7
What to do
Update the plugin to 2.7.7 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation.CVE-2019-19982 · WordPress plugins & themes · reported by MITREMedium 5.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name= request.
Fixed in
4.2.3
What to do
Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Dec 4, 2019The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.CVE-2019-19589 · WordPress plugins & themes · reported by MITRECritical 9.8
The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerability reported in PDF Embedder Plugin is not valid as the plugin itself doesn't control or manage the file upload process. It only serves the uploaded PDF files and the responsibility of uploading PDF file remains with the Site owner of Wordpress installation, the upload of PDF file is managed by Wordpress core and not by PDF Embedder Plugin. Control & block of polyglot file is required to be taken care at the time of upload, not on showing the file. Moreover, the reference mentions retrieving the files from the browser cache and manually renaming it to jar for executing the file. That refers to a two step non-connected steps which has nothing to do with PDF Embedder.
Affected
4.4 to 4.4
What to do
Affects 4.4 to 4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sejalivre.org wordpress.org
Dec 4, 2019The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanCVE-2019-19133 · WordPress plugins & themes · reported by MITREMedium 6.1
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.
Product
CSS Hero
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update CSS Hero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 26, 2019The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.CVE-2015-9538 · WordPress plugins & themes · reported by MITREMedium 6.5
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.
Product
NextGEN Gallery
Fixed in
2.1.15
What to do
Update NextGEN Gallery to 2.1.15 or newer.
Full record and what to do →NVD record cxsecurity.com cybersecurityworks.com
Nov 18, 2019The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album,CVE-2019-14467 · WordPress plugins & themes · reported by MITREHigh 7.8
The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.CVE-2019-17235 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.
Product
includes/class-coming-soon-creator.php in the igniteup
Affected
up to 3.4
What to do
Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.CVE-2019-17234 · WordPress plugins & themes · reported by MITREHigh 7.5
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
Product
includes/class-coming-soon-creator.php in the igniteup
Affected
up to 3.4
What to do
Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Nov 11, 2019A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ...CVE-2019-18854 · WordPress plugins & themes · reported by MITREHigh 7.5
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring.
Product
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG)
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com plugins.trac.wordpress.org
Nov 8, 2019A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers.CVE-2019-17661 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC.
Product
codepress-admin-columns (aka Admin Columns)
Affected
3.4.6 to 3.4.6
What to do
Affects 3.4.6 to 3.4.6. Update codepress-admin-columns (aka Admin Columns) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record www2.deloitte.com www2.deloitte.com
Nov 6, 2019Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote CVE-2014-9014 · WordPress plugins & themes · reported by MITREMedium 4.3
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote authenticated users to download arbitrary files via a .. (dot dot) in the file parameter.
Product
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace
Fixed in
2.4.1
What to do
Update Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace to 2.4.1 or newer.
Full record and what to do →NVD record security.szurek.pl exploit-db.com
Nov 6, 2019The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary userCVE-2014-9013 · WordPress plugins & themes · reported by MITREHigh 8.8
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.
Product
WP Marketplace
Affected
2.4.0 to 2.4.0
What to do
Affects 2.4.0 to 2.4.0. Update WP Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 31, 2019plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.CVE-2019-16251 · WordPress plugins & themes · reported by MITREMedium 4.3
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
Product
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Oct 23, 2019The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x bCVE-2015-9524 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1CVE-2015-9523 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1CVE-2015-9522 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2CVE-2015-9521 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.