Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
214 results · page 5 of 5
Mar 24, 2014Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrarCVE-2013-1408 · WordPress plugins & themes · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
- Product
- Multiple SQL injection vulnerabilities in the Wysija Newsletters
- Fixed in
- 2.2.1
- What to do
- Update Multiple SQL injection vulnerabilities in the Wysija Newsletters to 2.2.1 or newer.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Jan 20, 2014WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might alloCVE-2010-5297 · WordPress plugins & themes · reported by MITRELow 2.1
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
- Fixed in
- 3.0.1
- What to do
- Update the plugin to 3.0.1 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Jan 3, 2014Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML CVE-2013-6993 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php.
- Product
- Ad-minister
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update Ad-minister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgsecurityfocus.com
May 31, 2013Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb plugin before 1.9 for WordPress allows remote authenticated administrators to injecCVE-2013-3720 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb plugin before 1.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wp_post_id parameter.
- Product
- Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb
- Fixed in
- 1.9
- What to do
- Update Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb to 1.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com
Dec 27, 2012WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discoverCVE-2012-5868 · WordPress plugins & themes · reported by MITRELow 2.6
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwhiteoaksecurity.comwhiteoaksecurity.com
Oct 24, 2012Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to injecCVE-2012-5388 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.
- Product
- White Label CMS
- What to do
- Update White Label CMS to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.orgwordpress.org
Sep 14, 2012wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a nCVE-2012-4422 · WordPress plugins & themes · reported by Red HatLow 3.5
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.
- Fixed in
- 3.4.2
- What to do
- Update the plugin to 3.4.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Apr 21, 2012wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-widCVE-2012-2402 · WordPress plugins & themes · reported by MITREMedium 5.5
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.
- Fixed in
- 3.3.2
- What to do
- Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD recordcore.trac.wordpress.orgosvdb.org
Aug 18, 2009the administrator interface in WordPress before 2.8.2: Cross-site scripting (XSS)CVE-2009-2851 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.
- Product
- the administrator interface in WordPress before 2.8.2
- Fixed in
- 2.8.2
- What to do
- Update the administrator interface in WordPress before 2.8.2 to 2.8.2 or newer.
Full record and what to do →NVD recordbugs.gentoo.orgsecuritytracker.com
Aug 13, 2009wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, viCVE-2009-2762 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordarchives.neohapsis.comcore.trac.wordpress.org
Jul 10, 2009wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which alloCVE-2009-2334 · WordPress plugins & themes · reported by MITREMedium 4.9
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
- Fixed in
- 2.8.1
- What to do
- Update the plugin to 2.8.1 or newer.
Full record and what to do →NVD recordcorelabs.coresecurity.comsecuritytracker.com
May 21, 2008WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files: Unrestricted file uploadCVE-2008-2392 · WordPress plugins & themes · reported by MITREHigh 9
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
- Product
- WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Feb 6, 2008the administration panel in the DMSGuestbook 1.7.0 plugin for: SQL injectionCVE-2008-0616 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors. NOTE: it is not clear whether this issue crosses privilege boundaries.
- Product
- the administration panel in the DMSGuestbook 1.7.0 plugin for
- Affected
- 1.7.0 to 1.7.0
- What to do
- Affects 1.7.0 to 1.7.0. Update the administration panel in the DMSGuestbook 1.7.0 plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Aug 3, 2007Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) CVE-2007-4153 · WordPress plugins & themes · reported by MITRELow 2.1
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordcodex.wordpress.orgmybeni.rootzilla.de
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.