Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

545new WordPress flaws this week

391,964entries in the database

4,896 results · page 83 of 98

Jun 13, 2017SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter CVE-2017-9603 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php.
Product
SQL injection vulnerability in the WP Jobs
Fixed in
1.5
What to do
Update SQL injection vulnerability in the WP Jobs to 1.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jun 13, 2017SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to CVE-2017-9429 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php.
Product
Event List
Affected
0.7.8 to 0.7.8
What to do
Affects 0.7.8 to 0.7.8. Update Event List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jun 12, 2017SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid paraCVE-2017-9418 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php.
Product
WP-Testimonials
Affected
3.4.1 to 3.4.1
What to do
Affects 3.4.1 to 3.4.1. Update WP-Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Jun 8, 2017The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to readCVE-2015-3634 · WordPress plugins & themes · reported by MITREHigh 7.5
The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.
Product
SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8
Affected
up to 2.2.21
What to do
Affects up to 2.2.21. Update SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jun 7, 2017Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.CVE-2014-9310 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.
Product
Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox
Fixed in
4.1
What to do
Update Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox to 4.1 or newer.
Full record and what to do →NVD record securityfocus.com security.szurek.pl
Jun 5, 2017Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via theCVE-2017-9420 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.
Product
Cross site scripting (XSS) vulnerability in the Spiffy Calendar
Fixed in
3.3.0
What to do
Update Cross site scripting (XSS) vulnerability in the Spiffy Calendar to 3.3.0 or newer.
Full record and what to do →NVD record spiffycalendar.sunnythemes.com securityfocus.com
Jun 1, 2017The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.CVE-2017-9337 · WordPress plugins & themes · reported by MITREMedium 6.1
The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.
Affected
2.5 to 2.5
What to do
Affects 2.5 to 2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lncken.cn lncken.cn
Jun 1, 2017The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.CVE-2017-9336 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.
Affected
1.6 to 1.6
What to do
Affects 1.6 to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lncken.cn lncken.cn
May 29, 2017Raygun4WP plugin 1.8.0: A reflected XSS in sendtesterrorCVE-2017-9288 · WordPress plugins & themes · reported by MITREMedium 6.1
The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).
Product
Raygun4WP plugin 1.8.0
Affected
1.8.0 to 1.8.0
What to do
Affects 1.8.0 to 1.8.0. Update Raygun4WP plugin 1.8.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jgj212.blogspot.kr github.com
May 23, 2017upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variabCVE-2015-5682 · WordPress plugins & themes · reported by MITREHigh 7.5
upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com vapid.dhs.org
May 23, 2017Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathnamCVE-2015-5609 · WordPress plugins & themes · reported by MITRECritical 9.1
Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.
Product
Image Export
Affected
1.1 to 1.1
What to do
Affects 1.1 to 1.1. Update Image Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
May 23, 2017Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathnaCVE-2015-5469 · WordPress plugins & themes · reported by MITREHigh 7.5
Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.
Product
MDC YouTube Downloader
Affected
2.1.0 to 2.1.0
What to do
Affects 2.1.0 to 2.1.0. Update MDC YouTube Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
May 23, 2017Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2015-5468 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to includes/download.php.
Product
Directory traversal vulnerability in the WP e-Commerce Shop Styling
Fixed in
2.6
What to do
Update Directory traversal vulnerability in the WP e-Commerce Shop Styling to 2.6 or newer.
Full record and what to do →NVD record openwall.com openwall.com
May 23, 2017Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2015-4704 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the File parameter to download.php.
Product
Download Zip Attachments
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Download Zip Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com vapid.dhs.org
May 23, 2017Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote atCVE-2015-4455 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
Product
Aviary Image Editor Add-on For Gravity Forms
Affected
up to 3.0
What to do
Affects up to 3.0. Update Aviary Image Editor Add-on For Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com vapid.dhs.org
May 17, 2017Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redireCVE-2015-4070 · WordPress plugins & themes · reported by MITREMedium 6.1
Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Product
Wow Moodboard Lite
Affected
1.1.1 to 1.1.1
What to do
Affects 1.1.1 to 1.1.1. Update Wow Moodboard Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapid.dhs.org
May 17, 2017Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers toCVE-2015-3998 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
Product
adsense-click-fraud-monitoring
Affected
1.7.5 to 1.7.5
What to do
Affects 1.7.5 to 1.7.5. Update adsense-click-fraud-monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
May 10, 2017CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL.CVE-2017-8875 · WordPress plugins & themes · reported by MITREMedium 6.5
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL.
Product
CSRF in the Clean Login
Fixed in
1.8
What to do
Update CSRF in the Clean Login to 1.8 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Apr 24, 2017There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings.CVE-2017-8100 · WordPress plugins & themes · reported by MITREMedium 6.5
There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings.
Product
There is CSRF in the CopySafe Web Protection
Fixed in
2.6
What to do
Update There is CSRF in the CopySafe Web Protection to 2.6 or newer.
Full record and what to do →NVD record seclists.org securityfocus.com
Apr 24, 2017There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.CVE-2017-8099 · WordPress plugins & themes · reported by MITREHigh 8.1
There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.
Product
There is CSRF in the WHIZZ
Fixed in
1.1.1
What to do
Update There is CSRF in the WHIZZ to 1.1.1 or newer.
Full record and what to do →NVD record seclists.org plugins.trac.wordpress.org
Apr 24, 2017XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.CVE-2017-7723 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.
Fixed in
1.2.5
What to do
Update the plugin to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 12, 2017SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendarCVE-2017-7719 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.
Product
SQL injection in the Spider Event Calendar (aka spider-event-calendar)
Fixed in
1.5.52
What to do
Update SQL injection in the Spider Event Calendar (aka spider-event-calendar) to 1.5.52 or newer.
Full record and what to do →NVD record lists.openwall.net securityfocus.com
Mar 17, 2017An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress.CVE-2017-6955 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack.
Product
An issue was discovered in by-email/by-email.php in the Invite Anyone
Fixed in
1.3.15
What to do
Update An issue was discovered in by-email/by-email.php in the Invite Anyone to 1.3.15 or newer.
Full record and what to do →NVD record securityfocus.com github.com
Mar 17, 2017An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress.CVE-2017-6954 · WordPress plugins & themes · reported by MITREMedium 4.3
An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.
Product
An issue was discovered in includes/component.php in the BuddyPress Docs
Fixed in
1.9.3
What to do
Update An issue was discovered in includes/component.php in the BuddyPress Docs to 1.9.3 or newer.
Full record and what to do →NVD record securityfocus.com github.com
Mar 16, 2017Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remotCVE-2016-0770 · WordPress plugins & themes · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable.
Product
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory
Fixed in
8.5.9
What to do
Update Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory to 8.5.9 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 11, 2017In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.CVE-2017-6816 · WordPress plugins & themes · reported by MITREMedium 4.9
In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 11, 2017In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.CVE-2017-6815 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
Fixed in
4.7.3
What to do
Update the plugin to 4.7.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6578 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: subscriber_email.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6577 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6576 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/campaign-delete.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6575 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: member_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6574 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6573 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit-list.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6572 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/add_member.php with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6571 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 9, 2017A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6570 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign-list.php with the GET Parameter: id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com github.com
Mar 2, 2017Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.CVE-2017-6104 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
Affected
up to 3.0
What to do
Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Mar 2, 2017Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1.CVE-2017-6103 · WordPress plugins & themes · reported by larry0@me.comMedium 6.1
Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1.
Affected
0.1.1 to 0.1.1
What to do
Affects 0.1.1 to 0.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Mar 2, 2017Persistent XSS in wordpress plugin rockhoist-badges v1.2.2.CVE-2017-6102 · WordPress plugins & themes · reported by larry0@me.comMedium 6.1
Persistent XSS in wordpress plugin rockhoist-badges v1.2.2.
Affected
1.2.2 to 1.2.2
What to do
Affects 1.2.2 to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6098 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication to Wordpress admin) with the POST Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6097 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authentication to Wordpress admin) with the POST Parameter: camp_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6096 · WordPress plugins & themes · reported by MITREHigh 7.2
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires authentication to Wordpress admin) with the GET Parameter: filter_list.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 21, 2017A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress.CVE-2017-6095 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with the GET Parameter: list_id.
Product
Mail Masta (aka mail-masta)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Mail Masta (aka mail-masta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Feb 10, 2017An issue was discovered in the WP Mail plugin before 1.2 for WordPress.CVE-2017-5942 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allow you to execute JavaScript in the context of the user receiving the mail.
Product
An issue was discovered in the WP Mail
Fixed in
1.2
What to do
Update An issue was discovered in the WP Mail to 1.2 or newer.
Full record and what to do →NVD record securityfocus.com cjc.im
Jan 23, 2017Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL comCVE-2016-0769 · WordPress plugins & themes · reported by Red HatHigh 8.8
Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
Product
eShop
Affected
6.3.14 to 6.3.14
What to do
Affects 6.3.14 to 6.3.14. Update eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 23, 2017Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web CVE-2016-0765 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter.
Product
eShop
Affected
6.3.14 to 6.3.14
What to do
Affects 6.3.14 to 6.3.14. Update eShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 18, 2017the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6: Cross-site request forgery (CSRF)CVE-2016-6897 · WordPress plugins & themes · reported by MITREMedium 6.5
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
Product
the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6
Fixed in
4.6
What to do
Update the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 to 4.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 18, 2017the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3: Directory traversalCVE-2016-6896 · WordPress plugins & themes · reported by MITREHigh 7.1
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.
Product
the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3
What to do
Update the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 to the newest version.
Full record and what to do →NVD record openwall.com securitytracker.com
Jan 18, 2017The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_pluginsCVE-2016-10148 · WordPress plugins & themes · reported by MITREMedium 4.3
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.
Fixed in
4.6
What to do
Update the plugin to 4.6 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 3, 2017Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary webCVE-2016-10112 · WordPress plugins & themes · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted tax-rate table values in CSV format.
Product
Cross-site scripting (XSS) vulnerability in the WooCommerce
Fixed in
2.6.9
What to do
Update Cross-site scripting (XSS) vulnerability in the WooCommerce to 2.6.9 or newer.
Full record and what to do →NVD record securityfocus.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.