Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

413new WordPress flaws this week

399,200entries in the database

24,771 results · page 481 of 496

Aug 20, 2019The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.CVE-2015-9320 · WordPress plugins & themes · reported by MITREMedium 6.1
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
Product
option-tree
Fixed in
2.5.4
What to do
Update option-tree to 2.5.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.CVE-2015-9332 · WordPress plugins & themes · reported by MITREMedium 6.5
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Product
uninstall
Fixed in
1.2
What to do
Update uninstall to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Product
wp-all-import
Fixed in
3.2.4
What to do
Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.CVE-2015-9330 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.CVE-2015-9317 · WordPress plugins & themes · reported by MITREMedium 6.1
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
Product
awesome-support
Fixed in
3.1.7
What to do
Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.CVE-2019-15082 · WordPress plugins & themes · reported by MITREMedium 6.1
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.
Product
360-product-rotation
Fixed in
1.4.8
What to do
Update 360-product-rotation to 1.4.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.CVE-2019-15113 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
Product
companion-sitemap-generator
Fixed in
3.7.0
What to do
Update companion-sitemap-generator to 3.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.CVE-2018-20973 · WordPress plugins & themes · reported by MITRECritical 9.8
The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.CVE-2018-20972 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.CVE-2017-18543 · WordPress plugins & themes · reported by MITRECritical 9.8
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.CVE-2015-9324 · WordPress plugins & themes · reported by MITRECritical 9.8
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Product
easy-digital-downloads
Fixed in
2.3.3
What to do
Update easy-digital-downloads to 2.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.CVE-2015-9323 · WordPress plugins & themes · reported by MITRECritical 9.8
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Product
404-to-301
Fixed in
2.0.3
What to do
Update 404-to-301 to 2.0.3 or newer.
Full record and what to do →NVD record github.com wordpress.org
Aug 16, 2019The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.CVE-2014-10376 · WordPress plugins & themes · reported by MITRECritical 9.8
The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
Product
i-recommend-this
Fixed in
3.7.3
What to do
Update i-recommend-this to 3.7.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The note-press plugin before 0.1.2 for WordPress has SQL injection.CVE-2017-18548 · WordPress plugins & themes · reported by MITRECritical 9.8
The note-press plugin before 0.1.2 for WordPress has SQL injection.
Product
note-press
Fixed in
0.1.2
What to do
Update note-press to 0.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The olimometer plugin before 2.57 for WordPress has SQL injection.CVE-2016-10904 · WordPress plugins & themes · reported by MITRECritical 9.8
The olimometer plugin before 2.57 for WordPress has SQL injection.
Product
olimometer
Fixed in
2.57
What to do
Update olimometer to 2.57 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.CVE-2015-9326 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
Product
wp-business-intelligence-lite
Fixed in
1.6.3
What to do
Update wp-business-intelligence-lite to 1.6.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The visitors-online plugin before 0.4 for WordPress has SQL injection.CVE-2015-9325 · WordPress plugins & themes · reported by MITRECritical 9.8
The visitors-online plugin before 0.4 for WordPress has SQL injection.
Product
visitors-online
Fixed in
0.4
What to do
Update visitors-online to 0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultCVE-2019-14788 · WordPress plugins & themes · reported by MITREHigh 8.8
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
Product
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters
Fixed in
4.6.19
What to do
Update wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.CVE-2019-14784 · WordPress plugins & themes · reported by MITREMedium 6.1
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
Product
CP Contact Form with PayPal
Fixed in
1.2.98
What to do
Update CP Contact Form with PayPal to 1.2.98 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress.CVE-2019-13578 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Product
A SQL injection vulnerability exists in the Impress GiveWP Give
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update A SQL injection vulnerability exists in the Impress GiveWP Give to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Aug 15, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-pCVE-2019-14800 · WordPress plugins & themes · reported by MITREMedium 5.3
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.
Product
FV Flowplayer Video Player
Fixed in
7.3.15.727
What to do
Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 15, 2019The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked CVE-2019-14795 · WordPress plugins & themes · reported by MITREMedium 4.8
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,CVE-2019-14790 · WordPress plugins & themes · reported by MITREMedium 6.1
The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.CVE-2017-18513 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
Product
responsive-menu
Fixed in
3.1.4
What to do
Update responsive-menu to 3.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Product
custom-sidebars
Fixed in
3.1.0
What to do
Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.CVE-2016-10888 · WordPress plugins & themes · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.7
What to do
Update all-in-one-wp-security-and-firewall to 4.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.CVE-2016-10887 · WordPress plugins & themes · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.9
What to do
Update all-in-one-wp-security-and-firewall to 4.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.CVE-2016-10886 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
Product
wp-editor
Fixed in
1.2.6
What to do
Update wp-editor to 1.2.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.CVE-2015-9310 · WordPress plugins & themes · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.1
What to do
Update all-in-one-wp-security-and-firewall to 3.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.CVE-2015-9307 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Product
wp-google-map-plugin
Fixed in
2.3.10
What to do
Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 14, 2019The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.CVE-2019-15025 · WordPress plugins & themes · reported by MITRECritical 9.8
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
Product
ninja-forms
Fixed in
3.3.21.2
What to do
Update ninja-forms to 3.3.21.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18514 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.CVE-2016-10889 · WordPress plugins & themes · reported by MITRECritical 9.8
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
Product
nextgen-gallery
Fixed in
2.1.57
What to do
Update nextgen-gallery to 2.1.57 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameterCVE-2015-9316 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Product
wp-fastest-cache
Fixed in
0.8.4.9
What to do
Update wp-fastest-cache to 0.8.4.9 or newer.
Full record and what to do →NVD record wordpress.org exploit-db.com
Aug 14, 2019The newstatpress plugin before 1.0.1 for WordPress has SQL injection.CVE-2015-9315 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Product
newstatpress
Fixed in
1.0.1
What to do
Update newstatpress to 1.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.CVE-2015-9313 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Product
newstatpress
Fixed in
1.0.5
What to do
Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.CVE-2017-18515 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
Product
wp-statistics
Fixed in
12.0.8
What to do
Update wp-statistics to 12.0.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.CVE-2017-18495 · WordPress plugins & themes · reported by MITREMedium 6.1
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
Product
gravity-forms-sms-notifications
Fixed in
2.4.0
What to do
Update gravity-forms-sms-notifications to 2.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.CVE-2016-10871 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
Product
mailchimp-for-wp
Fixed in
4.0.11
What to do
Update mailchimp-for-wp to 4.0.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.CVE-2016-10868 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
Product
all-in-one-wp-security-and-firewall
Fixed in
4.0.5
What to do
Update all-in-one-wp-security-and-firewall to 4.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The liveforms plugin before 3.2.0 for WordPress has SQL injection.CVE-2015-9301 · WordPress plugins & themes · reported by MITRECritical 9.8
The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Product
liveforms
Fixed in
3.2.0
What to do
Update liveforms to 3.2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has code injection.CVE-2015-9298 · WordPress plugins & themes · reported by MITRECritical 9.8
The events-manager plugin before 5.6 for WordPress has code injection.
Product
events-manager
Fixed in
5.6
What to do
Update events-manager to 5.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.CVE-2015-9294 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.5
What to do
Update all-in-one-wp-security-and-firewall to 3.9.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.CVE-2019-14946 · WordPress plugins & themes · reported by MITREMedium 5.4
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
Product
ultimate-member
Fixed in
2.0.52
What to do
Update ultimate-member to 2.0.52 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.CVE-2017-18506 · WordPress plugins & themes · reported by MITREMedium 6.1
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
Product
woocommerce-pdf-invoices-packing-slips
Fixed in
2.0.13
What to do
Update woocommerce-pdf-invoices-packing-slips to 2.0.13 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.CVE-2015-9305 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
Product
wp-google-map-plugin
Fixed in
2.3.7
What to do
Update wp-google-map-plugin to 2.3.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.CVE-2019-14801 · WordPress plugins & themes · reported by MITRECritical 9.8
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.
Product
FV Flowplayer Video Player
Fixed in
7.3.15.727
What to do
Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=CVE-2019-14798 · WordPress plugins & themes · reported by MITREMedium 4.9
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
Product
10Web Photo Gallery
Fixed in
1.5.25
What to do
Update 10Web Photo Gallery to 1.5.25 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.CVE-2019-14791 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
Affected
1.3.18 to 1.3.18
What to do
Affects 1.3.18 to 1.3.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.CVE-2019-14799 · WordPress plugins & themes · reported by MITREMedium 6.1
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
Product
FV Flowplayer Video Player
Fixed in
7.3.14.727
What to do
Update FV Flowplayer Video Player to 7.3.14.727 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.