Updated 0 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

537 results · page 7 of 11

Jan 13, 2020The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.CVE-2019-20210 · WordPress plugins & themes · reported by MITREMedium 6.1
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.
Fixed in
2.3.4
What to do
Update the plugin to 2.3.4 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jan 13, 2020The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-adCVE-2019-20209 · WordPress plugins & themes · reported by MITREHigh 7.5
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.
Fixed in
2.3.4
What to do
Update the plugin to 2.3.4 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jan 10, 2020The ultimate-weather plugin 1.0 for WordPress has XSSCVE-2014-4561 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-weather plugin 1.0 for WordPress has XSS
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019WordPress Xorbin Digital Flash Clock 1.0 has XSSCVE-2013-4693 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress Xorbin Digital Flash Clock 1.0 has XSS
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 27, 2019Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remoCVE-2014-4559 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) api_key, (2) payment_page_url, (3) merchant_id, (4) api_url, or (5) currency parameter.
Product
Swipe Checkout for WP e-Commerce
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Swipe Checkout for WP e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 12, 2019The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.CVE-2019-19198 · WordPress plugins & themes · reported by MITREMedium 5.4
The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.
Affected
1.1.0 to 1.1.0
What to do
Affects 1.1.0 to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Nov 18, 2019The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album,CVE-2019-14467 · WordPress plugins & themes · reported by MITREHigh 7.8
The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 22, 2019The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.CVE-2015-9495 · WordPress plugins & themes · reported by MITREMedium 6.1
The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.
Product
syndication-links
Fixed in
1.0.3
What to do
Update syndication-links to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 10, 2019The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.CVE-2015-9469 · WordPress plugins & themes · reported by MITREMedium 4.8
The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Oct 10, 2019The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.CVE-2019-17072 · WordPress plugins & themes · reported by MITRECritical 9.8
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
Affected
1.0.9 to 1.0.9
What to do
Affects 1.0.9 to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordpress.org
Oct 10, 2019The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.CVE-2019-17070 · WordPress plugins & themes · reported by MITREMedium 6.1
The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.
Product
liquid-speech-balloon (aka LIQUID SPEECH BALLOON)
Fixed in
1.0.7
What to do
Update liquid-speech-balloon (aka LIQUID SPEECH BALLOON) to 1.0.7 or newer.
Full record and what to do →NVD record gist.github.com wordpress.org
Sep 26, 2019The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.CVE-2015-9442 · WordPress plugins & themes · reported by MITREMedium 6.5
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.CVE-2015-9440 · WordPress plugins & themes · reported by MITREMedium 6.5
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
Product
monetize
Affected
up to 1.03
What to do
Affects up to 1.03. Update monetize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.CVE-2015-9419 · WordPress plugins & themes · reported by MITREMedium 6.1
The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.
Affected
1.0.6 to 1.0.6
What to do
Affects 1.0.6 to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.CVE-2015-9415 · WordPress plugins & themes · reported by MITREHigh 7.5
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.
Product
bj-lazy-load
Fixed in
1.0
What to do
Update bj-lazy-load to 1.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The wp-piwik plugin before 1.0.5 for WordPress has XSS.CVE-2015-9405 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-piwik plugin before 1.0.5 for WordPress has XSS.
Product
wp-piwik
Fixed in
1.0.5
What to do
Update wp-piwik to 1.0.5 or newer.
Full record and what to do →NVD record github.com wordpress.org
Sep 20, 2019The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.CVE-2016-10997 · WordPress plugins & themes · reported by MITREMedium 6.5
The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Sep 20, 2019The relevant plugin before 1.0.8 for WordPress has XSS.CVE-2015-9384 · WordPress plugins & themes · reported by MITREMedium 6.1
The relevant plugin before 1.0.8 for WordPress has XSS.
Product
relevant
Fixed in
1.0.8
What to do
Update relevant to 1.0.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 17, 2019The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.CVE-2016-10992 · WordPress plugins & themes · reported by MITREMedium 6.1
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
Product
music-store
Fixed in
1.0.43
What to do
Update music-store to 1.0.43 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 17, 2019The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.CVE-2016-10991 · WordPress plugins & themes · reported by MITREHigh 7.5
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.
Product
imdb-widget
Fixed in
1.0.9
What to do
Update imdb-widget to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 17, 2019The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.CVE-2016-10986 · WordPress plugins & themes · reported by MITREMedium 6.1
The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.
Product
tweet-wheel
Fixed in
1.0.3.3
What to do
Update tweet-wheel to 1.0.3.3 or newer.
Full record and what to do →NVD record 0x62626262.wordpress.com wordpress.org
Sep 16, 2019The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.CVE-2016-10967 · WordPress plugins & themes · reported by MITREMedium 6.1
The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mukarramkhalid.com wordpress.org
Sep 16, 2019The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.CVE-2016-10966 · WordPress plugins & themes · reported by MITREHigh 7.5
The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mukarramkhalid.com wordpress.org
Sep 16, 2019The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.CVE-2016-10965 · WordPress plugins & themes · reported by MITREHigh 7.5
The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mukarramkhalid.com wordpress.org
Sep 16, 2019The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.CVE-2016-10964 · WordPress plugins & themes · reported by MITREMedium 6.1
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.
Product
dwnldr
Fixed in
1.01
What to do
Update dwnldr to 1.01 or newer.
Full record and what to do →NVD record rastating.github.io wordpress.org
Sep 16, 2019The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.CVE-2016-10956 · WordPress plugins & themes · reported by MITREHigh 7.5
The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cxsecurity.com wordpress.org
Sep 13, 2019The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.CVE-2017-18612 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record rastating.github.io wordpress.org
Sep 13, 2019The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.CVE-2016-10940 · WordPress plugins & themes · reported by MITREHigh 7.2
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Sep 13, 2019The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.CVE-2016-10938 · WordPress plugins & themes · reported by MITREMedium 6.5
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 10, 2019The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.CVE-2017-18604 · WordPress plugins & themes · reported by MITREHigh 7.5
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
Product
sitebuilder-dynamic-components
Affected
up to 1.0
What to do
Affects up to 1.0. Update sitebuilder-dynamic-components to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 10, 2019The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.CVE-2017-18602 · WordPress plugins & themes · reported by MITREHigh 8.8
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 10, 2019The examapp plugin 1.0 for WordPress has XSS via exam input text fields.CVE-2017-18601 · WordPress plugins & themes · reported by MITREMedium 5.4
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 3, 2019The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.CVE-2019-15865 · WordPress plugins & themes · reported by MITREHigh 8.8
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.
Product
breadcrumbs-by-menu
Fixed in
1.0.3
What to do
Update breadcrumbs-by-menu to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.CVE-2019-15864 · WordPress plugins & themes · reported by MITREMedium 6.1
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.
Product
breadcrumbs-by-menu
Fixed in
1.0.3
What to do
Update breadcrumbs-by-menu to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.CVE-2019-15834 · WordPress plugins & themes · reported by MITREHigh 8.8
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
Product
webp-converter-for-media
Fixed in
1.0.3
What to do
Update webp-converter-for-media to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 28, 2019Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9375 · WordPress plugins & themes · reported by MITREMedium 6.1
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Table Rate Shipping Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Table Rate Shipping Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9373 · WordPress plugins & themes · reported by MITREMedium 6.1
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
PayPal Pro Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update PayPal Pro Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9371 · WordPress plugins & themes · reported by MITREMedium 6.1
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Manual Purchases Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Manual Purchases Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9369 · WordPress plugins & themes · reported by MITREMedium 6.1
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Easy US Sales Taxes Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Easy US Sales Taxes Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9367 · WordPress plugins & themes · reported by MITREMedium 6.1
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Easy Canadian Sales Taxes Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Easy Canadian Sales Taxes Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9366 · WordPress plugins & themes · reported by MITREMedium 6.1
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Custom URL Tracking Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Custom URL Tracking Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9365 · WordPress plugins & themes · reported by MITREMedium 6.1
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Authorize.net Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Authorize.net Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 20192Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9364 · WordPress plugins & themes · reported by MITREMedium 6.1
2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
2Checkout Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update 2Checkout Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9362 · WordPress plugins & themes · reported by MITREMedium 6.1
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Post Connector
Fixed in
1.0.4
What to do
Update Post Connector to 1.0.4 or newer.
Full record and what to do →NVD record barrykooij.com barrykooij.com
Aug 27, 2019The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.CVE-2017-18592 · WordPress plugins & themes · reported by MITREHigh 7.5
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
Product
woocommerce-catalog-enquiry
Fixed in
3.1.0
What to do
Update woocommerce-catalog-enquiry to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.CVE-2015-9348 · WordPress plugins & themes · reported by MITREHigh 7.5
The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
Product
sell-downloads
Fixed in
1.0.8
What to do
Update sell-downloads to 1.0.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.CVE-2019-15645 · WordPress plugins & themes · reported by MITREHigh 8.8
The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
Product
zoho-salesiq
Fixed in
1.0.9
What to do
Update zoho-salesiq to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.CVE-2019-15644 · WordPress plugins & themes · reported by MITREMedium 6.1
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
Product
zoho-salesiq
Fixed in
1.0.9
What to do
Update zoho-salesiq to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.CVE-2015-9347 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
Product
wp-plotly
Fixed in
1.0.3
What to do
Update wp-plotly to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The cp-polls plugin before 1.0.5 for WordPress has XSS.CVE-2015-9346 · WordPress plugins & themes · reported by MITREMedium 6.1
The cp-polls plugin before 1.0.5 for WordPress has XSS.
Product
cp-polls
Fixed in
1.0.5
What to do
Update cp-polls to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.