Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

4,893 results · page 66 of 98

Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.CVE-2019-15823 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
Product
wps-hide-login
Fixed in
1.5.3
What to do
Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 30, 2019The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.CVE-2019-15822 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.
Product
wps-child-theme-generator
Fixed in
1.2
What to do
Update wps-child-theme-generator to 1.2 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 30, 2019The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.CVE-2019-15821 · WordPress plugins & themes · reported by MITREHigh 7.5
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Product
bold-page-builder
Fixed in
2.3.2
What to do
Update bold-page-builder to 2.3.2 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.CVE-2019-15820 · WordPress plugins & themes · reported by MITREMedium 6.1
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
Product
login-or-logout-menu-item
Fixed in
1.2.0
What to do
Update login-or-logout-menu-item to 1.2.0 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15819 · WordPress plugins & themes · reported by MITRECritical 9.8
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Product
nd-restaurant-reservations
Fixed in
1.5
What to do
Update nd-restaurant-reservations to 1.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301CVE-2019-15818 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
Product
simple-301-redirects-addon-bulk-uploader
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update simple-301-redirects-addon-bulk-uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The easy-property-listings plugin before 3.4 for WordPress has XSS.CVE-2019-15817 · WordPress plugins & themes · reported by MITREMedium 6.1
The easy-property-listings plugin before 3.4 for WordPress has XSS.
Product
easy-property-listings
Fixed in
3.4
What to do
Update easy-property-listings to 3.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.CVE-2019-15816 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
Product
wp-private-content-plus
Fixed in
2.0
What to do
Update wp-private-content-plus to 2.0 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 30, 2019The photo-gallery plugin before 1.2.42 for WordPress has CSRF.CVE-2015-9380 · WordPress plugins & themes · reported by MITREHigh 8.8
The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
Product
photo-gallery
Fixed in
1.2.42
What to do
Update photo-gallery to 1.2.42 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 29, 2019cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such CVE-2019-14979 · WordPress plugins & themes · reported by MITREMedium 5.3
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
Product
WooCommerce PayPal Checkout Payment Gateway
Affected
1.6.17 to 1.6.17
What to do
Affects 1.6.17 to 1.6.17. Update WooCommerce PayPal Checkout Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gkaim.com wordpress.org
Aug 29, 2019/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as dCVE-2019-14978 · WordPress plugins & themes · reported by MITREMedium 5.3
/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price.
Product
WooCommerce PayU India Payment Gateway
Affected
2.1.1 to 2.1.1
What to do
Affects 2.1.1 to 2.1.1. Update WooCommerce PayU India Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gkaim.com wpvulndb.com
Aug 29, 2019The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.CVE-2019-15781 · WordPress plugins & themes · reported by MITREHigh 8.8
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
Product
facebook-by-weblizar
Fixed in
2.8.5
What to do
Update facebook-by-weblizar to 2.8.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.CVE-2019-15779 · WordPress plugins & themes · reported by MITREHigh 8.8
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.
Product
insta-gallery
Fixed in
2.4.8
What to do
Update insta-gallery to 2.4.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.CVE-2019-15778 · WordPress plugins & themes · reported by MITREMedium 5.4
The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.
Product
woo-variation-gallery
Fixed in
1.1.29
What to do
Update woo-variation-gallery to 1.1.29 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15771 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-shortcodes
Fixed in
6.0
What to do
Update nd-shortcodes to 6.0 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.CVE-2019-15780 · WordPress plugins & themes · reported by MITRECritical 9.8
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.
Product
formidable
Fixed in
4.02.01
What to do
Update formidable to 4.02.01 or newer.
Full record and what to do →NVD record pentest.co.uk raw.githubusercontent.com
Aug 29, 2019The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.CVE-2019-15777 · WordPress plugins & themes · reported by MITREMedium 5.4
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
Product
shapepress-dsgvo
Fixed in
2.2.19
What to do
Update shapepress-dsgvo to 2.2.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.CVE-2019-15776 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
Product
simple-301-redirects-addon-bulk-uploader
Fixed in
1.2.5
What to do
Update simple-301-redirects-addon-bulk-uploader to 1.2.5 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15775 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-learning
Fixed in
4.8
What to do
Update nd-learning to 4.8 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15774 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-booking
Fixed in
2.5
What to do
Update nd-booking to 2.5 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15773 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-travel
Fixed in
1.7
What to do
Update nd-travel to 1.7 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-15772 · WordPress plugins & themes · reported by MITREMedium 6.1
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Product
nd-donations
Fixed in
1.4
What to do
Update nd-donations to 1.4 or newer.
Full record and what to do →NVD record threatpost.com wordpress.org
Aug 29, 2019The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.CVE-2019-15770 · WordPress plugins & themes · reported by MITREHigh 8.8
The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.
Product
woo-address-book
Fixed in
1.6.0
What to do
Update woo-address-book to 1.6.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.CVE-2019-15769 · WordPress plugins & themes · reported by MITREHigh 8.8
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
Product
handl-utm-grabber
Fixed in
2.6.5
What to do
Update handl-utm-grabber to 2.6.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.CVE-2018-21007 · WordPress plugins & themes · reported by MITRECritical 9.8
The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.
Product
woo-confirmation-email
Fixed in
3.2.0
What to do
Update woo-confirmation-email to 3.2.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 28, 2019The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9359 · WordPress plugins & themes · reported by MITREMedium 6.1
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Jetpack
Fixed in
3.4.3
What to do
Update Jetpack to 3.4.3 or newer.
Full record and what to do →NVD record blog.sucuri.net jetpack.com
Aug 28, 2019The my-calendar plugin before 3.1.10 for WordPress has XSS.CVE-2019-15713 · WordPress plugins & themes · reported by MITREMedium 6.1
The my-calendar plugin before 3.1.10 for WordPress has XSS.
Product
my-calendar
Fixed in
3.1.10
What to do
Update my-calendar to 3.1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.CVE-2017-18593 · WordPress plugins & themes · reported by MITREMedium 6.1
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
Product
updraftplus
Fixed in
1.13.5
What to do
Update updraftplus to 1.13.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9362 · WordPress plugins & themes · reported by MITREMedium 6.1
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Post Connector
Fixed in
1.0.4
What to do
Update Post Connector to 1.0.4 or newer.
Full record and what to do →NVD record barrykooij.com barrykooij.com
Aug 28, 2019The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9361 · WordPress plugins & themes · reported by MITREMedium 6.1
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Related Posts
Fixed in
1.8.2
What to do
Update Related Posts to 1.8.2 or newer.
Full record and what to do →NVD record blog.sucuri.net barrykooij.com
Aug 28, 2019The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9360 · WordPress plugins & themes · reported by MITREMedium 6.1
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
updraftplus
Fixed in
1.9.64
What to do
Update updraftplus to 1.9.64 or newer.
Full record and what to do →NVD record blog.sucuri.net updraftplus.com
Aug 28, 2019The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9358 · WordPress plugins & themes · reported by MITREMedium 6.1
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
feedwordpress
Fixed in
2015.0514
What to do
Update feedwordpress to 2015.0514 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The akismet plugin before 3.1.5 for WordPress has XSS.CVE-2015-9357 · WordPress plugins & themes · reported by MITREMedium 6.1
The akismet plugin before 3.1.5 for WordPress has XSS.
Product
akismet
Fixed in
3.1.5
What to do
Update akismet to 3.1.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.CVE-2015-9356 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
Product
wp-vipergb
Fixed in
1.3.16
What to do
Update wp-vipergb to 1.3.16 or newer.
Full record and what to do →NVD record make.wordpress.org wordpress.org
Aug 28, 2019The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.CVE-2015-9355 · WordPress plugins & themes · reported by MITREMedium 6.1
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Product
two-factor-authentication
Fixed in
1.1.10
What to do
Update two-factor-authentication to 1.1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The gigpress plugin before 2.3.11 for WordPress has XSS.CVE-2015-9354 · WordPress plugins & themes · reported by MITREMedium 4.8
The gigpress plugin before 2.3.11 for WordPress has XSS.
Product
gigpress
Fixed in
2.3.11
What to do
Update gigpress to 2.3.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.CVE-2015-9353 · WordPress plugins & themes · reported by MITREHigh 7.2
The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Product
gigpress
Fixed in
2.3.11
What to do
Update gigpress to 2.3.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The sharebar plugin before 1.2.2 for WordPress has SQL injection.CVE-2012-6719 · WordPress plugins & themes · reported by MITRECritical 9.8
The sharebar plugin before 1.2.2 for WordPress has SQL injection.
Product
sharebar
Fixed in
1.2.2
What to do
Update sharebar to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.CVE-2012-6718 · WordPress plugins & themes · reported by MITREMedium 6.1
The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.
Product
sharebar
Fixed in
1.2.2
What to do
Update sharebar to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.CVE-2012-6717 · WordPress plugins & themes · reported by MITREMedium 6.1
The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.
Product
redirection
Fixed in
2.2.12
What to do
Update redirection to 2.2.12 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.CVE-2011-5329 · WordPress plugins & themes · reported by MITREMedium 6.1
The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.
Product
redirection
Fixed in
2.2.9
What to do
Update redirection to 2.2.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.CVE-2019-14314 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.
Product
A SQL injection vulnerability exists in the Imagely NextGEN Gallery
Fixed in
3.2.11
What to do
Update A SQL injection vulnerability exists in the Imagely NextGEN Gallery to 3.2.11 or newer.
Full record and what to do →NVD record de.wordpress.org wordpress.org
Aug 27, 2019The wp-members plugin before 3.2.8 for WordPress has CSRF.CVE-2019-15660 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-members plugin before 3.2.8 for WordPress has CSRF.
Product
wp-members
Fixed in
3.2.8
What to do
Update wp-members to 3.2.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme upCVE-2019-15650 · WordPress plugins & themes · reported by MITREMedium 4.3
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
Product
stops-core-theme-and-plugin-updates
Fixed in
8.0.5
What to do
Update stops-core-theme-and-plugin-updates to 8.0.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.CVE-2017-18592 · WordPress plugins & themes · reported by MITREHigh 7.5
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
Product
woocommerce-catalog-enquiry
Fixed in
3.1.0
What to do
Update woocommerce-catalog-enquiry to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.CVE-2017-18591 · WordPress plugins & themes · reported by MITREMedium 6.1
The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
Product
gd-rating-system
Fixed in
2.1
What to do
Update gd-rating-system to 2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.CVE-2016-10936 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
Product
wp-polls
Fixed in
2.73.1
What to do
Update wp-polls to 2.73.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-polls plugin before 2.72 for WordPress has SQL injection.CVE-2015-9352 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-polls plugin before 2.72 for WordPress has SQL injection.
Product
wp-polls
Fixed in
2.72
What to do
Update wp-polls to 2.72 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.CVE-2015-9351 · WordPress plugins & themes · reported by MITRECritical 9.8
The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
Product
feed-them-social
Fixed in
1.7.0
What to do
Update feed-them-social to 1.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.CVE-2015-9350 · WordPress plugins & themes · reported by MITREMedium 6.1
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
Product
feed-them-social
Fixed in
1.7.0
What to do
Update feed-them-social to 1.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.