Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

591 results · page 9 of 12

Sep 13, 2019The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.CVE-2016-10944 · WordPress plugins & themes · reported by MITREHigh 8.8
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
Product
multisite-post-duplicator
Fixed in
1.1.3
What to do
Update multisite-post-duplicator to 1.1.3 or newer.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-15872 · WordPress plugins & themes · reported by MITRECritical 9.8
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.CVE-2019-15871 · WordPress plugins & themes · reported by MITREMedium 4.3
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Aug 30, 2019The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.CVE-2019-15842 · WordPress plugins & themes · reported by MITREMedium 6.1
The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
Product
easy-pdf-restaurant-menu-upload
Fixed in
1.1.2
What to do
Update easy-pdf-restaurant-menu-upload to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.CVE-2019-15832 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
Product
visitors-traffic-real-time-statistics
Fixed in
1.13
What to do
Update visitors-traffic-real-time-statistics to 1.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.CVE-2019-15831 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
Product
visitors-traffic-real-time-statistics
Fixed in
1.12
What to do
Update visitors-traffic-real-time-statistics to 1.12 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.CVE-2019-15830 · WordPress plugins & themes · reported by MITREMedium 5.4
The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.
Product
icegram
Fixed in
1.10.29
What to do
Update icegram to 1.10.29 or newer.
Full record and what to do →NVD record blog.sucuri.net wordpress.org
Aug 30, 2019The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.CVE-2019-15829 · WordPress plugins & themes · reported by MITREMedium 4.8
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
Product
photoblocks-grid-gallery
Fixed in
1.1.33
What to do
Update photoblocks-grid-gallery to 1.1.33 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.CVE-2019-15827 · WordPress plugins & themes · reported by MITREMedium 5.4
The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.
Product
onesignal-free-web-push-notifications
Fixed in
1.17.8
What to do
Update onesignal-free-web-push-notifications to 1.17.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as dCVE-2019-14978 · WordPress plugins & themes · reported by MITREMedium 5.3
/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price.
Product
WooCommerce PayU India Payment Gateway
Affected
2.1.1 to 2.1.1
What to do
Affects 2.1.1 to 2.1.1. Update WooCommerce PayU India Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gkaim.com wpvulndb.com
Aug 29, 2019The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.CVE-2019-15778 · WordPress plugins & themes · reported by MITREMedium 5.4
The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.
Product
woo-variation-gallery
Fixed in
1.1.29
What to do
Update woo-variation-gallery to 1.1.29 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 28, 2019Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9375 · WordPress plugins & themes · reported by MITREMedium 6.1
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Table Rate Shipping Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Table Rate Shipping Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9373 · WordPress plugins & themes · reported by MITREMedium 6.1
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
PayPal Pro Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update PayPal Pro Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9371 · WordPress plugins & themes · reported by MITREMedium 6.1
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Manual Purchases Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Manual Purchases Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9369 · WordPress plugins & themes · reported by MITREMedium 6.1
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Easy US Sales Taxes Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Easy US Sales Taxes Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019The my-calendar plugin before 3.1.10 for WordPress has XSS.CVE-2019-15713 · WordPress plugins & themes · reported by MITREMedium 6.1
The my-calendar plugin before 3.1.10 for WordPress has XSS.
Product
my-calendar
Fixed in
3.1.10
What to do
Update my-calendar to 3.1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.CVE-2017-18593 · WordPress plugins & themes · reported by MITREMedium 6.1
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
Product
updraftplus
Fixed in
1.13.5
What to do
Update updraftplus to 1.13.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9367 · WordPress plugins & themes · reported by MITREMedium 6.1
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Easy Canadian Sales Taxes Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Easy Canadian Sales Taxes Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9366 · WordPress plugins & themes · reported by MITREMedium 6.1
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Custom URL Tracking Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Custom URL Tracking Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9365 · WordPress plugins & themes · reported by MITREMedium 6.1
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Authorize.net Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update Authorize.net Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 20192Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9364 · WordPress plugins & themes · reported by MITREMedium 6.1
2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
2Checkout Add-on for iThemes Exchange
Fixed in
1.1.0
What to do
Update 2Checkout Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9363 · WordPress plugins & themes · reported by MITREMedium 6.1
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
iThemes Exchange
Fixed in
1.12.0
What to do
Update iThemes Exchange to 1.12.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 28, 2019The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.CVE-2015-9355 · WordPress plugins & themes · reported by MITREMedium 6.1
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Product
two-factor-authentication
Fixed in
1.1.10
What to do
Update two-factor-authentication to 1.1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.CVE-2018-21006 · WordPress plugins & themes · reported by MITREHigh 8.8
The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.
Product
bbp-move-topics
Fixed in
1.1.6
What to do
Update bbp-move-topics to 1.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.CVE-2018-21005 · WordPress plugins & themes · reported by MITRECritical 9.8
The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.
Product
bbp-move-topics
Fixed in
1.1.6
What to do
Update bbp-move-topics to 1.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.CVE-2019-15329 · WordPress plugins & themes · reported by MITREHigh 8.8
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.CVE-2019-15328 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-15327 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
Product
import-users-from-csv-with-meta
Fixed in
1.14.1.3
What to do
Update import-users-from-csv-with-meta to 1.14.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-15326 · WordPress plugins & themes · reported by MITREHigh 7.5
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
Product
import-users-from-csv-with-meta
Fixed in
1.14.2.1
What to do
Update import-users-from-csv-with-meta to 1.14.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18573 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.CVE-2016-10916 · WordPress plugins & themes · reported by MITRECritical 9.8
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
Product
appointment-booking-calendar
Fixed in
1.1.24
What to do
Update appointment-booking-calendar to 1.1.24 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.CVE-2015-9335 · WordPress plugins & themes · reported by MITRECritical 9.8
The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.
Product
limit-attempts
Fixed in
1.1.1
What to do
Update limit-attempts to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-10380 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
Product
profile-builder
Fixed in
1.1.66
What to do
Update profile-builder to 1.1.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The booking-sms plugin before 1.1.0 for WordPress has XSS.CVE-2017-18555 · WordPress plugins & themes · reported by MITREMedium 6.1
The booking-sms plugin before 1.1.0 for WordPress has XSS.
Product
booking-sms
Fixed in
1.1.0
What to do
Update booking-sms to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.CVE-2017-18554 · WordPress plugins & themes · reported by MITREMedium 6.1
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
Product
analytics-tracker
Fixed in
1.1.1
What to do
Update analytics-tracker to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.CVE-2016-10903 · WordPress plugins & themes · reported by MITREHigh 8.8
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
Product
GoDaddy godaddy-email-marketing-sign-up-forms
Fixed in
1.1.3
What to do
Update GoDaddy godaddy-email-marketing-sign-up-forms to 1.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.CVE-2015-9321 · WordPress plugins & themes · reported by MITREMedium 6.1
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Product
shortcode-factory
Fixed in
1.1.1
What to do
Update shortcode-factory to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The realty plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18532 · WordPress plugins & themes · reported by MITREMedium 6.1
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
realty
Fixed in
1.1.0
What to do
Update realty to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.CVE-2017-18529 · WordPress plugins & themes · reported by MITREMedium 6.1
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
Product
promobar
Fixed in
1.1.1
What to do
Update promobar to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.CVE-2017-18518 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
Product
bws-smtp
Fixed in
1.1.0
What to do
Update bws-smtp to 1.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.CVE-2017-18512 · WordPress plugins & themes · reported by MITREHigh 8.8
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
Product
newsletter-by-supsystic
Fixed in
1.1.8
What to do
Update newsletter-by-supsystic to 1.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18514 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.CVE-2017-18488 · WordPress plugins & themes · reported by MITREMedium 6.1
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
Product
Backup Guard
Fixed in
1.1.47
What to do
Update Backup Guard to 1.1.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.CVE-2017-18500 · WordPress plugins & themes · reported by MITREMedium 6.1
The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
Product
social-buttons-pack
Fixed in
1.1.1
What to do
Update social-buttons-pack to 1.1.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 8, 2019The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.CVE-2019-14683 · WordPress plugins & themes · reported by MITREMedium 5.7
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Product
codection "Import users from CSV with meta
Fixed in
1.14.2.2
What to do
Update codection "Import users from CSV with meta to 1.14.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 8, 2019The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.CVE-2019-14681 · WordPress plugins & themes · reported by MITREHigh 8.8
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
Product
Deny All Firewall
Fixed in
1.1.7
What to do
Update Deny All Firewall to 1.1.7 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Jul 11, 2019The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.CVE-2019-13505 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
Affected
1.1.44 to 1.1.44
What to do
Affects 1.1.44 to 1.1.44. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
May 27, 2019XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress.CVE-2019-12345 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress.
Product
XSS exists in the Kiboko Hostel
Fixed in
1.1.4
What to do
Update XSS exists in the Kiboko Hostel to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
May 23, 2019In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/CVE-2019-10866 · WordPress plugins & themes · reported by MITRECritical 9.8
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
Product
In the Form Maker
Fixed in
1.13.3
What to do
Update In the Form Maker to 1.13.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Apr 29, 2019The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion CVE-2019-11591 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form
Fixed in
1.13.5
What to do
Update WebDorado Contact Form to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.