Critical security advisoryCriticalFlagged by our vulnerability database: A flaw in WordPress’s own updater is being exploited. Sites need 7.1.4. See if your site is affectedFlagged by our vulnerability database: WordPress updater flaw is being exploited. DetailsExploited: WordPress 7.1.4. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list
35added in the last 30 days
413new WordPress flaws this week
399,200entries in the database

24,771 results · page 486 of 496

  • Oct 18, 2017The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widgeCVE-2014-8491 · WordPress plugins & themes · reported by MITREMedium 5.3

    The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widget_default/gallery.php or (2) flash-album-gallery/skins/banner_widget_default/gallery.php.

    Product
    Grand Flagallery
    Fixed in
    4.25
    What to do
    Update Grand Flagallery to 4.25 or newer.

    Full record and what to do →NVD recordg0blin.co.ukwpvulndb.com

  • Oct 17, 2017Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers CVE-2015-7806 · WordPress plugins & themes · reported by MITRECritical 9.8

    Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors.

    Product
    Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager
    Fixed in
    1.7.3
    What to do
    Update Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager to 1.7.3 or newer.

    Full record and what to do →NVD recordappcheck-ng.complugins.trac.wordpress.org

  • Oct 16, 2017SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_custCVE-2014-8621 · WordPress plugins & themes · reported by MITRECritical 9.8

    SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_custom_field parameter to sl-xml.php.

    Product
    SQL injection vulnerability in the Store Locator plugin 2.3
    Affected
    up to 3.11
    What to do
    Affects up to 3.11. Update SQL injection vulnerability in the Store Locator plugin 2.3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordg0blin.co.ukwpvulndb.com

  • Oct 16, 2017Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress.CVE-2017-15375 · WordPress plugins & themes · reported by MITREMedium 6.1

    Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules. Remote attackers are able to inject malicious script code to hijack admin session credentials via the backend, or to manipulate the backend on client-side performed requests. The attack vector is non-persistent and the request method to inject is GET. The attacker does not need a privileged user account to perform a successful exploitation.

    Affected
    4.5.1 to 4.5.1
    What to do
    Affects 4.5.1 to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com

  • Oct 12, 2017WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) aCVE-2016-9263 · WordPress plugins & themes · reported by MITREMedium 4.7

    WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.

    Affected
    up to 4.8.2
    What to do
    Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecurityfocus.comopnsec.com

  • Oct 6, 2017The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WorCVE-2015-2673 · WordPress plugins & themes · reported by MITREHigh 8.8

    The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain administrator privileges and execute arbitrary code via the option_name and option_value parameters.

    Affected
    up to 3.0.20
    What to do
    Affects up to 3.0.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordblog.rastating.comblog.rastating.com

  • Oct 6, 2017The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.CVE-2017-15079 · WordPress plugins & themes · reported by MITREHigh 7.5

    The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.

    Product
    Smush Image Compression and Optimization
    Fixed in
    2.7.6
    What to do
    Update Smush Image Compression and Optimization to 2.7.6 or newer.

    Full record and what to do →NVD recordwordpress.orgwordpress.org

  • Oct 6, 2017Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web scripCVE-2014-7240 · WordPress plugins & themes · reported by MITREMedium 6.1

    Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a master_response action to wp-admin/admin-ajax.php.

    Product
    Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution
    Fixed in
    1.7
    What to do
    Update Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution to 1.7 or newer.

    Full record and what to do →NVD recordg0blin.co.ukwpvulndb.com

  • Oct 2, 2017WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it CVE-2017-14990 · WordPress plugins & themes · reported by MITREMedium 6.5

    WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecuritytracker.comcore.trac.wordpress.org

  • Oct 2, 2017WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.CVE-2017-14848 · WordPress plugins & themes · reported by MITREHigh 8.8

    WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.

    Affected
    1.0 to 1.0
    What to do
    Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordwpvulndb.comexploit-db.com

  • Sep 29, 2017The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cCVE-2015-9234 · WordPress plugins & themes · reported by MITREHigh 7.2

    The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.

    Product
    cp-contact-form-with-paypal (aka CP Contact Form with PayPal)
    Fixed in
    1.1.6
    What to do
    Update cp-contact-form-with-paypal (aka CP Contact Form with PayPal) to 1.1.6 or newer.

    Full record and what to do →NVD recordseclists.orgseclists.org

  • Sep 28, 2017Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) tCVE-2017-14507 · WordPress plugins & themes · reported by MITRECritical 9.8

    Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php or (3) pages/content_timeline_index.php.

    Product
    Content Timeline
    Affected
    4.4.2 to 4.4.2
    What to do
    Affects 4.4.2 to 4.4.2. Update Content Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordwpvulndb.comexploit-db.com

  • Sep 27, 2017Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14847 · WordPress plugins & themes · reported by MITREHigh 8.8

    Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordexploit-db.comexploit-db.com

  • Sep 27, 2017Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14846 · WordPress plugins & themes · reported by MITREHigh 8.8

    Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordexploit-db.comexploit-db.com

  • Sep 27, 2017Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14845 · WordPress plugins & themes · reported by MITREHigh 8.8

    Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordexploit-db.comexploit-db.com

  • Sep 27, 2017Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.CVE-2017-14844 · WordPress plugins & themes · reported by MITREHigh 8.8

    Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordexploit-db.comexploit-db.com

  • Sep 27, 2017Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14843 · WordPress plugins & themes · reported by MITREHigh 8.8

    Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordexploit-db.comexploit-db.com

  • Sep 27, 2017Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.CVE-2017-14842 · WordPress plugins & themes · reported by MITREHigh 8.8

    Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordexploit-db.comexploit-db.com

  • Sep 27, 2017The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_deCVE-2017-14766 · WordPress plugins & themes · reported by MITREHigh 7.5

    The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_del_st_submit() function in functions.php only require knowing the student id number.

    Product
    Simple Student Result
    Fixed in
    1.6.4
    What to do
    Update Simple Student Result to 1.6.4 or newer.

    Full record and what to do →NVD recordlimbenjamin.comwordpress.org

  • Sep 27, 2017SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recuCVE-2017-14760 · WordPress plugins & themes · reported by MITRECritical 9.8

    SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.

    Product
    event-espresso-free (aka Event Espresso Lite)
    Affected
    up to 3.1.37.12.l
    What to do
    Affects up to 3.1.37.12.l. Update event-espresso-free (aka Event Espresso Lite) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsstrunk.comsstrunk.com

  • Sep 26, 2017The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.CVE-2017-14751 · WordPress plugins & themes · reported by MITREMedium 6.1

    The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordbbs.microdesktop.comsecurityfocus.com

  • Sep 26, 2017Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute aCVE-2015-7670 · WordPress plugins & themes · reported by MITRECritical 9.8

    Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) id parameter.

    Product
    Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System
    Fixed in
    1.2.1
    What to do
    Update Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System to 1.2.1 or newer.

    Full record and what to do →NVD recordsecurityfocus.comwordpress.org

  • Sep 25, 2017SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the CVE-2017-14125 · WordPress plugins & themes · reported by MITRECritical 9.8

    SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to wp-admin/admin.php.

    Product
    SQL injection vulnerability in the Responsive Image Gallery
    Fixed in
    1.2.1
    What to do
    Update SQL injection vulnerability in the Responsive Image Gallery to 1.2.1 or newer.

    Full record and what to do →NVD recordseclists.orgwpvulndb.com

  • Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.CVE-2017-14726 · WordPress plugins & themes · reported by MITREMedium 6.1

    Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 23, 2017Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php.CVE-2017-14725 · WordPress plugins & themes · reported by MITREMedium 5.4

    Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.CVE-2017-14724 · WordPress plugins & themes · reported by MITREMedium 6.1

    Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 23, 2017Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility oCVE-2017-14723 · WordPress plugins & themes · reported by MITRECritical 9.8

    Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 23, 2017Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.CVE-2017-14722 · WordPress plugins & themes · reported by MITREHigh 7.5

    Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 23, 2017Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.CVE-2017-14721 · WordPress plugins & themes · reported by MITREMedium 6.1

    Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 23, 2017Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.CVE-2017-14720 · WordPress plugins & themes · reported by MITREMedium 6.1

    Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.CVE-2017-14719 · WordPress plugins & themes · reported by MITREHigh 7.5

    Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 23, 2017Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.CVE-2017-14718 · WordPress plugins & themes · reported by MITREMedium 6.1

    Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 20, 2017WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.CVE-2015-2826 · WordPress plugins & themes · reported by MITREMedium 5.3

    WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.

    What to do
    Update the plugin to the newest version.

    Full record and what to do →NVD recordpacketstormsecurity.comseclists.org

  • Sep 19, 2017Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPreCVE-2015-4089 · WordPress plugins & themes · reported by MITREHigh 8.8

    Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.

    Fixed in
    0.8.3.5
    What to do
    Update the plugin to 0.8.3.5 or newer.

    Full record and what to do →NVD recordopenwall.comwordpress.org

  • Sep 17, 2017WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstraCVE-2017-14530 · WordPress plugins & themes · reported by MITREHigh 8

    WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences.

    Product
    WP_Admin_UI in the Crony Cronjob Manager
    Fixed in
    0.4.7
    What to do
    Update WP_Admin_UI in the Crony Cronjob Manager to 0.4.7 or newer.

    Full record and what to do →NVD recordcybersecurityworks.comgithub.com

  • Sep 14, 2017Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter CVE-2017-1002028 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.

    Affected
    1.0 to 1.0
    What to do
    Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameterCVE-2017-1002026 · WordPress plugins & themes · reported by larry0@me.comHigh 8.8

    Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.

    Affected
    3.1.37.11.l to 3.1.37.11.l
    What to do
    Affects 3.1.37.11.l to 3.1.37.11.l. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.CVE-2017-1002022 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.

    Affected
    1.01.8 to 1.01.8
    What to do
    Affects 1.01.8 to 1.01.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.CVE-2017-1002020 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.

    Affected
    1.01.8 to 1.01.8
    What to do
    Affects 1.01.8 to 1.01.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the eCVE-2017-1002019 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.

    Affected
    1.02.2 to 1.02.2
    What to do
    Affects 1.02.2 to 1.02.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the evCVE-2017-1002018 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.

    Affected
    1.02.2 to 1.02.2
    What to do
    Affects 1.02.2 to 1.02.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallerCVE-2017-1002015 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter.

    Affected
    1.5.2 to 1.5.2
    What to do
    Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name paCVE-2017-1002014 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter.

    Affected
    1.5.2 to 1.5.2
    What to do
    Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.phpCVE-2017-1002013 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php.

    Affected
    1.5.2 to 1.5.2
    What to do
    Affects 1.5.2 to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 14, 2017Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/CVE-2017-1002002 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

    Affected
    2.0 to 2.0
    What to do
    Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com

  • Sep 14, 2017Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.CVE-2017-1002001 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8

    Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

    Affected
    1.05 to 1.05
    What to do
    Affects 1.05 to 1.05. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordvapidlabs.comwordpress.org

  • Sep 12, 2017In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extensionCVE-2015-9228 · WordPress plugins & themes · reported by MITREHigh 8.8

    In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.

    Product
    Photocrati NextGEN Gallery
    What to do
    Update Photocrati NextGEN Gallery to the newest version.

    Full record and what to do →NVD recordopenwall.comcybersecurityworks.com

  • Sep 11, 2017The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of aCVE-2017-14313 · WordPress plugins & themes · reported by MITREMedium 6.1

    The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().

    Product
    shibboleth_login_form function in shibboleth.php in the Shibboleth
    Fixed in
    1.8
    What to do
    Update shibboleth_login_form function in shibboleth.php in the Shibboleth to 1.8 or newer.

    Full record and what to do →NVD recorddebian.orgbugs.debian.org

  • Sep 11, 2017PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticateCVE-2015-8351 · WordPress plugins & themes · reported by MITRECritical 9

    PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.

    Product
    PHP remote file inclusion vulnerability in the Gwolle Guestbook
    Fixed in
    1.5.4
    What to do
    Update PHP remote file inclusion vulnerability in the Gwolle Guestbook to 1.5.4 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

  • Sep 11, 2017Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web scriCVE-2015-8350 · WordPress plugins & themes · reported by MITREMedium 6.1

    Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.

    Product
    Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action
    Fixed in
    2.5.1
    What to do
    Update Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action to 2.5.1 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.