Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

413new WordPress flaws this week

399,200entries in the database

24,771 results · page 487 of 496

Sep 7, 2017SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.CVE-2015-3314 · WordPress plugins & themes · reported by MITREHigh 8.1
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
Fixed in
1.5.5
What to do
Update the plugin to 1.5.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Sep 7, 2017SQL injection vulnerability in WordPress Community Events plugin before 1.4.CVE-2015-3313 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in WordPress Community Events plugin before 1.4.
Fixed in
1.4
What to do
Update the plugin to 1.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Sep 7, 2017SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questioCVE-2017-9834 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.
Product
SQL injection vulnerability in the WatuPRO
Fixed in
5.5.3.7
What to do
Update SQL injection vulnerability in the WatuPRO to 5.5.3.7 or newer.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Aug 29, 2017Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commaCVE-2015-7517 · WordPress plugins & themes · reported by Red HatCritical 9.8
Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or (2) class-doifd-landing-page.php in public/includes/.
Product
Multiple SQL injection vulnerabilities in the Double Opt-In for Download
Fixed in
2.0.9
What to do
Update Multiple SQL injection vulnerabilities in the Double Opt-In for Download to 2.0.9 or newer.
Full record and what to do →NVD record permalink.gmane.org securityfocus.com
Aug 28, 2017BackupGuard prior to version 1.1.47: Cross-site scriptingCVE-2017-10837 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
BackupGuard prior to version 1.1.47
Affected
up to 1.1.46
What to do
Affects up to 1.1.46. Update BackupGuard prior to version 1.1.47 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Aug 23, 2017The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.CVE-2017-13137 · WordPress plugins & themes · reported by MITRECritical 9.8
The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.
Affected
1.0.5 to 1.0.5
What to do
Affects 1.0.5 to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 20, 2017The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() iCVE-2017-12977 · WordPress plugins & themes · reported by MITREHigh 7.2
The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.
Product
Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery
Fixed in
1.3.51
What to do
Update Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery to 1.3.51 or newer.
Full record and what to do →NVD record github.com wordpress.org
Aug 18, 2017lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parCVE-2017-12949 · WordPress plugins & themes · reported by MITREHigh 8.8
lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF.
Product
Podlove Podcast Publisher
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Aug 18, 2017classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameCVE-2017-12947 · WordPress plugins & themes · reported by MITREHigh 7.2
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.
Product
classes\controller\admin\modals.php in the Easy Modal
Fixed in
2.1.0
What to do
Update classes\controller\admin\modals.php in the Easy Modal to 2.1.0 or newer.
Full record and what to do →NVD record defensecode.com wordpress.org
Aug 18, 2017classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameteCVE-2017-12946 · WordPress plugins & themes · reported by MITREHigh 7.2
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.
Product
classes\controller\admin\modals.php in the Easy Modal
Fixed in
2.1.0
What to do
Update classes\controller\admin\modals.php in the Easy Modal to 2.1.0 or newer.
Full record and what to do →NVD record defensecode.com wordpress.org
Aug 7, 2017SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header.CVE-2017-12650 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header.
Product
SQL Injection exists in the Loginizer
Fixed in
1.3.6
What to do
Update SQL Injection exists in the Loginizer to 1.3.6 or newer.
Full record and what to do →NVD record blog.wpscans.com sv.wordpress.org
Aug 7, 2017The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.CVE-2014-9260 · WordPress plugins & themes · reported by MITREHigh 8.8
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
Product
basic_settings function in the download manager
Fixed in
2.7.3
What to do
Update basic_settings function in the download manager to 2.7.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 2, 2017Simple Custom CSS and JS prior to version 3.4: Cross-site scriptingCVE-2017-2285 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Simple Custom CSS and JS prior to version 3.4
What to do
Update Simple Custom CSS and JS prior to version 3.4 to the newest version.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Aug 2, 2017Popup Maker prior to version 1.6.5: Cross-site scriptingCVE-2017-2284 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Popup Maker prior to version 1.6.5
What to do
Update Popup Maker prior to version 1.6.5 to the newest version.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Aug 2, 2017The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-iCVE-2017-12199 · WordPress plugins & themes · reported by MITRECritical 9.8
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-item, tag_group_update_order list_item, category_products_update_order category-product-item, custom_fields_update_order field-item, categories_update_order category-item, subcategories_update_order subcategory-item, and tags_update_order tag-list-item.
Affected
4.2.11 to 4.2.11
What to do
Affects 4.2.11 to 4.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Aug 1, 2017The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More TCVE-2017-12131 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.
Affected
3.0.4 to 3.0.4
What to do
Affects 3.0.4 to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Aug 1, 2017The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.CVE-2017-12068 · WordPress plugins & themes · reported by MITREMedium 6.1
The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.
Affected
0.7.9 to 0.7.9
What to do
Affects 0.7.9 to 0.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 26, 2017In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficientCVE-2017-11658 · WordPress plugins & themes · reported by MITREHigh 7.5
In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.
Product
WP Rocket
What to do
Update WP Rocket to the newest version.
Full record and what to do →NVD record gist.github.com wp-rocket.me
Jul 21, 2017The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which aCVE-2015-3421 · WordPress plugins & themes · reported by MITREMedium 6.1
The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.
Affected
up to 6.3.11
What to do
Affects up to 6.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com htbridge.com
Jul 17, 2017WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected siteCVE-2017-1000038 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site
Affected
3.5.7.1 to 3.5.7.1
What to do
Affects 3.5.7.1 to 3.5.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Jul 17, 2017Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in CVE-2017-1000033 · WordPress plugins & themes · reported by MITREMedium 6.1
Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user.
Affected
up to 1.3
What to do
Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cjc.im wpvulndb.com
Jul 7, 2017Shortcodes Ultimate prior to version 4.10.0: Directory traversalCVE-2017-2245 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors.
Product
Shortcodes Ultimate prior to version 4.10.0
Affected
up to 4.9.9
What to do
Affects up to 4.9.9. Update Shortcodes Ultimate prior to version 4.10.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com jvn.jp
Jul 7, 2017Responsive Lightbox prior to version 1.7.2: Cross-site scriptingCVE-2017-2243 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
Responsive Lightbox prior to version 1.7.2
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Responsive Lightbox prior to version 1.7.2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp securityfocus.com
Jul 7, 2017Event Calendar WD prior to version 1.0.94: Cross-site scriptingCVE-2017-2224 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Event Calendar WD prior to version 1.0.94
Affected
up to 1.0.93
What to do
Affects up to 1.0.93. Update Event Calendar WD prior to version 1.0.94 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com jvn.jp
Jul 7, 2017WP-Members prior to version 3.1.8: Cross-site scriptingCVE-2017-2222 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WP-Members prior to version 3.1.8
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update WP-Members prior to version 3.1.8 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jul 7, 2017WordPress Download Manager prior to version 2.9.51: Open redirectCVE-2017-2217 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Product
WordPress Download Manager prior to version 2.9.51
Affected
up to 2.9.50
What to do
Affects up to 2.9.50. Update WordPress Download Manager prior to version 2.9.51 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jul 7, 2017WordPress Download Manager prior to version 2.9.50: Cross-site scriptingCVE-2017-2216 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WordPress Download Manager prior to version 2.9.50
Affected
up to 2.9.49
What to do
Affects up to 2.9.49. Update WordPress Download Manager prior to version 2.9.50 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jun 13, 2017SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter CVE-2017-9603 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php.
Product
SQL injection vulnerability in the WP Jobs
Fixed in
1.5
What to do
Update SQL injection vulnerability in the WP Jobs to 1.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jun 13, 2017SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to CVE-2017-9429 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php.
Product
Event List
Affected
0.7.8 to 0.7.8
What to do
Affects 0.7.8 to 0.7.8. Update Event List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jun 12, 2017SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid paraCVE-2017-9418 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php.
Product
WP-Testimonials
Affected
3.4.1 to 3.4.1
What to do
Affects 3.4.1 to 3.4.1. Update WP-Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Jun 9, 2017the Multi Feed Reader prior to version 2.2.4: SQL injectionCVE-2017-2195 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in the Multi Feed Reader prior to version 2.2.4 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Product
the Multi Feed Reader prior to version 2.2.4
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update the Multi Feed Reader prior to version 2.2.4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jun 9, 2017WP Live Chat Support prior to version 7.0.07: Cross-site scriptingCVE-2017-2187 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WP Live Chat Support prior to version 7.0.07
Affected
up to 7.0.06
What to do
Affects up to 7.0.06. Update WP Live Chat Support prior to version 7.0.07 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Jun 8, 2017The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to readCVE-2015-3634 · WordPress plugins & themes · reported by MITREHigh 7.5
The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.
Product
SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8
Affected
up to 2.2.21
What to do
Affects up to 2.2.21. Update SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
May 22, 2017MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19: Cross-site scriptingCVE-2017-2169 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19
What to do
Update MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 to the newest version.
Full record and what to do →NVD record jvndb.jvn.jp jvn.jp
May 22, 2017WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7: Cross-site scriptingCVE-2017-2168 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7
What to do
Update WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 to the newest version.
Full record and what to do →NVD record jvndb.jvn.jp jvn.jp
May 18, 2017In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.CVE-2017-9066 · WordPress plugins & themes · reported by MITREHigh 8.6
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record securityfocus.com securitytracker.com
May 18, 2017In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.CVE-2017-9063 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
Fixed in
4.7.5
What to do
Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
May 17, 2017Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redireCVE-2015-4070 · WordPress plugins & themes · reported by MITREMedium 6.1
Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Product
Wow Moodboard Lite
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update Wow Moodboard Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapid.dhs.org
Apr 24, 2017There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings.CVE-2017-8100 · WordPress plugins & themes · reported by MITREMedium 6.5
There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings.
Product
There is CSRF in the CopySafe Web Protection
Fixed in
2.6
What to do
Update There is CSRF in the CopySafe Web Protection to 2.6 or newer.
Full record and what to do →NVD record seclists.org securityfocus.com
Apr 12, 2017SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendarCVE-2017-7719 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.
Product
SQL injection in the Spider Event Calendar (aka spider-event-calendar)
Fixed in
1.5.52
What to do
Update SQL injection in the Spider Event Calendar (aka spider-event-calendar) to 1.5.52 or newer.
Full record and what to do →NVD record lists.openwall.net securityfocus.com
Apr 2, 2017The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not requiCVE-2017-1001000 · WordPress plugins & themes · reported by 46fe6300-5254-4a98-9594-a9567bec8179High 7.5
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
Fixed in
4.7.2
What to do
Update the plugin to 4.7.2 or newer.
Full record and what to do →NVD record openwall.com securitytracker.com
Mar 16, 2017Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remotCVE-2016-0770 · WordPress plugins & themes · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable.
Product
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory
Fixed in
8.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory to 8.5.9 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 11, 2017In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.CVE-2017-6816 · WordPress plugins & themes · reported by MITREMedium 4.9
In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 11, 2017In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.CVE-2017-6815 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6578 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: subscriber_email.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6577 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6576 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/campaign-delete.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6575 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: member_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6574 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6573 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit-list.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.