Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

413new WordPress flaws this week

399,200entries in the database

24,771 results · page 485 of 496

Mar 14, 2018A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode pCVE-2018-8710 · WordPress plugins & themes · reported by MITRECritical 9.8
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.
Product
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF)
Fixed in
2.2.0
What to do
Update A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD record sec-consult.com wordpress.org
Mar 14, 2018the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter: Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL InjCVE-2018-1000131 · WordPress plugins & themes · reported by MITRECritical 9.8
Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later.
Product
the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter
Affected
up to 9.0.2
Fixed in
9.0.3
What to do
Update the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter to 9.0.3 or newer.
Full record and what to do →NVD record github.com wordpress.org
Mar 9, 2018WP All Import plugin prior to version 3.4.7 for: Cross-site scriptingCVE-2018-0547 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP All Import plugin prior to version 3.4.7 for
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update WP All Import plugin prior to version 3.4.7 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Mar 9, 2018WP All Import plugin prior to version 3.4.6 for: Cross-site scriptingCVE-2018-0546 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP All Import plugin prior to version 3.4.6 for
Fixed in
3.4.6
What to do
Update WP All Import plugin prior to version 3.4.6 for to 3.4.6 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Feb 6, 2018In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (fromCVE-2018-6389 · WordPress plugins & themes · reported by MITREHigh 7.5
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
Affected
up to 4.9.2
What to do
Affects up to 4.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Feb 6, 2018The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.CVE-2018-6467 · WordPress plugins & themes · reported by MITREHigh 8.8
The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.
Affected
5.3.1 to 5.3.1
What to do
Affects 5.3.1 to 5.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 5, 2018Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress.CVE-2015-4179 · WordPress plugins & themes · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress.
Product
Codestyling Localization
Affected
up to 1.99.30
What to do
Affects up to 1.99.30. Update Codestyling Localization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Feb 1, 2018WP Retina 2x prior to version 5.2.2: Cross-site scriptingCVE-2018-0511 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP Retina 2x prior to version 5.2.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
WP Retina 2x prior to version 5.2.2
Fixed in
5.2.2
What to do
Update WP Retina 2x prior to version 5.2.2 to 5.2.2 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jan 27, 2018The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray paramCVE-2018-6357 · WordPress plugins & themes · reported by MITREHigh 8.8
The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.
Product
acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget
Fixed in
3.2.6
What to do
Update acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget to 3.2.6 or newer.
Full record and what to do →NVD record lists.openwall.net wordpress.org
Jan 16, 2018The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.CVE-2017-18032 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.
Product
download-manager
Fixed in
2.9.52
What to do
Update download-manager to 2.9.52 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Jan 13, 2018The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-adminCVE-2018-5695 · WordPress plugins & themes · reported by MITREHigh 7.2
The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php.
Affected
4.4.4 to 4.4.4
What to do
Affects 4.4.4 to 4.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Jan 12, 2018The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.CVE-2018-5315 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jan 12, 2018The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5374 · WordPress plugins & themes · reported by MITREHigh 8.8
The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
Product
Dbox 3D Slider Lite
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Dbox 3D Slider Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 12, 2018The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).CVE-2018-5373 · WordPress plugins & themes · reported by MITREHigh 8.8
The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).
Product
Smooth Slider
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Smooth Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 12, 2018The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5372 · WordPress plugins & themes · reported by MITREHigh 8.8
The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
Product
Testimonial Slider
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 12, 2018The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.CVE-2018-5369 · WordPress plugins & themes · reported by MITREMedium 4.8
The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.
Affected
1.46 to 1.46
What to do
Affects 1.46 to 1.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php.CVE-2018-5368 · WordPress plugins & themes · reported by MITREHigh 8.8
The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php.
Affected
1.46 to 1.46
What to do
Affects 1.46 to 1.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.CVE-2018-5367 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.CVE-2018-5366 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.CVE-2018-5365 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.CVE-2018-5364 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language)CVE-2018-5363 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.CVE-2018-5362 · WordPress plugins & themes · reported by MITREMedium 4.8
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.CVE-2018-5361 · WordPress plugins & themes · reported by MITREHigh 8.8
The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.
Affected
1.9.6 to 1.9.6
What to do
Affects 1.9.6 to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 9, 2018The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt CVE-2018-5311 · WordPress plugins & themes · reported by MITREMedium 5.4
The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt URI.
Affected
2.4.6 to 2.4.6
What to do
Affects 2.4.6 to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.CVE-2018-5292 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.CVE-2018-5289 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.CVE-2018-5285 · WordPress plugins & themes · reported by MITREHigh 8.8
The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.
Affected
1.15 to 1.15
What to do
Affects 1.15 to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.CVE-2018-5284 · WordPress plugins & themes · reported by MITREMedium 4.8
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
Affected
1.15 to 1.15
What to do
Affects 1.15 to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.phCVE-2018-5213 · WordPress plugins & themes · reported by MITREMedium 5.4
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
Product
Simple Download Monitor
Fixed in
3.5.4
What to do
Update Simple Download Monitor to 3.5.4 or newer.
Full record and what to do →NVD record github.com github.com
Jan 4, 2018The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/CVE-2018-5212 · WordPress plugins & themes · reported by MITREMedium 5.4
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.
Product
Simple Download Monitor
Fixed in
3.5.4
What to do
Update Simple Download Monitor to 3.5.4 or newer.
Full record and what to do →NVD record github.com github.com
Jan 2, 2018Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker controlCVE-2017-1000434 · WordPress plugins & themes · reported by MITREMedium 6.1
Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker controlled page classes/Furigana.php: header('location:'.urldecode($_GET['furikake-redirect']));
Affected
0.1.0 to 0.1.0
What to do
Affects 0.1.0 to 0.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cjc.im wpvulndb.com
Jan 1, 2018SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in CVE-2018-3811 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords() function in smartgooglecode.php did not use prepared statements and did not sanitize the $_POST["oId"] variable before passing it as input into the SQL query.
Product
SQL Injection vulnerability in the Oturia Smart Google Code Inserter
Fixed in
3.5
What to do
Update SQL Injection vulnerability in the Oturia Smart Google Code Inserter to 3.5 or newer.
Full record and what to do →NVD record limbenjamin.com wordpress.org
Jan 1, 2018Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrarCVE-2018-3810 · WordPress plugins & themes · reported by MITRECritical 9.8
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.
Product
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter
Fixed in
3.5
What to do
Update Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter to 3.5 or newer.
Full record and what to do →NVD record limbenjamin.com wordpress.org
Dec 29, 2017The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtainCVE-2015-3302 · WordPress plugins & themes · reported by MITREHigh 7.5
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Product
TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin)
Fixed in
1.3.9.3
What to do
Update TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) to 1.3.9.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 27, 2017Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.CVE-2015-7666 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.
Fixed in
1.0.2
What to do
Update the plugin to 1.0.2 or newer.
Full record and what to do →NVD record securityfocus.com plugins.trac.wordpress.org
Dec 6, 2017The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.CVE-2017-17451 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.
Product
WP Mailster
Fixed in
1.5.5
What to do
Update WP Mailster to 1.5.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Dec 2, 2017wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers CVE-2017-17092 · WordPress plugins & themes · reported by MITREMedium 5.4
wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.
Fixed in
4.9.1
What to do
Update the plugin to 4.9.1 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Nov 27, 2017SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via the "keyword" paramCVE-2017-16955 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via the "keyword" parameter to /wp-admin/options-general.php?page=inlinks/inlinks.php.
Product
SQL injection vulnerability in the InLinks
Affected
up to 1.1
What to do
Affects up to 1.1. Update SQL injection vulnerability in the InLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Nov 17, 2017Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin canCVE-2017-1000227 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can
Affected
3.0.15 to 3.0.15
What to do
Affects 3.0.15 to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record security.dxw.com wpvulndb.com
Nov 17, 2017TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.CVE-2017-10889 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.
Affected
up to 1.8
What to do
Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Nov 17, 2017The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/adCVE-2017-16871 · WordPress plugins & themes · reported by MITREHigh 8.1
The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary
Product
UpdraftPlus
Affected
up to 1.13.12
What to do
Affects up to 1.13.12. Update UpdraftPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Nov 17, 2017The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget sCVE-2017-16870 · WordPress plugins & themes · reported by MITREHigh 8.1
The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary
Product
UpdraftPlus
Affected
up to 1.13.12
What to do
Affects up to 1.13.12. Update UpdraftPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Nov 14, 2017installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-contCVE-2017-16815 · WordPress plugins & themes · reported by MITREMedium 6.1
installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-content/plugins/duplicator/installer/build/view.step4.php) and "logging" (wp-content/plugins/duplicator/installer/build/view.step2.php) are not filtered correctly.
Product
installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup)
Fixed in
1.2.30
What to do
Update installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) to 1.2.30 or newer.
Full record and what to do →NVD record packetstormsecurity.com snapcreek.com
Nov 9, 2017The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain admCVE-2017-16562 · WordPress plugins & themes · reported by MITRECritical 9.8
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
Product
UserPro
Fixed in
4.9.17.1
What to do
Update UserPro to 4.9.17.1 or newer.
Full record and what to do →NVD record codecanyon.net wpvulndb.com
Nov 2, 2017WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugCVE-2017-16510 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.
Fixed in
4.8.3
What to do
Update the plugin to 4.8.3 or newer.
Full record and what to do →NVD record securityfocus.com blog.ircmaxell.com
Oct 26, 2017The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php.CVE-2017-15919 · WordPress plugins & themes · reported by MITRECritical 9.8
The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php.
Product
ultimate-form-builder-lite
Fixed in
1.3.7
What to do
Update ultimate-form-builder-lite to 1.3.7 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org
Oct 24, 2017Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.CVE-2017-15863 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.
Product
Cross Site Scripting (XSS) exists in the wp-noexternallinks
Fixed in
3.5.19
What to do
Update Cross Site Scripting (XSS) exists in the wp-noexternallinks to 3.5.19 or newer.
Full record and what to do →NVD record lists.openwall.net wordpress.org
Oct 23, 2017SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute CVE-2015-5533 · WordPress plugins & themes · reported by MITREHigh 7.2
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpd_keep_month parameter to wp-admin/options-general.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Product
SQL injection vulnerability in counter-options.php in the Count Per Day
Fixed in
3.4.1
What to do
Update SQL injection vulnerability in counter-options.php in the Count Per Day to 3.4.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 23, 2017The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.CVE-2017-15810 · WordPress plugins & themes · reported by MITREMedium 6.1
The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.
Product
PopCash.Net Code Integration Tool
Fixed in
1.1
What to do
Update PopCash.Net Code Integration Tool to 1.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.