Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

428 results · page 9 of 9

Apr 22, 2021Advanced Booking Calendar: Does not sanitise the license error messageCVE-2021-24232 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue
Product
Advanced Booking Calendar
Fixed in
1.6.8
What to do
Update Advanced Booking Calendar to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2021Advanced Booking Calendar: Did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tagCVE-2021-24225 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue
Product
Advanced Booking Calendar
Fixed in
1.6.7
What to do
Update Advanced Booking Calendar to 1.6.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 5, 2021This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data.CVE-2021-24169 · WordPress plugins & themes · reported by WPScanMedium 6.1
This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.
Fixed in
3.1.8
What to do
Update the plugin to 3.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Mar 31, 2021Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.CVE-2021-27349 · WordPress plugins & themes · reported by MITREMedium 6.1
Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.
Fixed in
3.1.8
What to do
Update the plugin to 3.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 18, 2021Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL atCVE-2021-24141 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks.
Fixed in
3.0.2
What to do
Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 6, 2021The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.CVE-2020-36172 · WordPress plugins & themes · reported by MITREMedium 6.1
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.
Product
Advanced Custom Fields
Fixed in
5.8.12
What to do
Update Advanced Custom Fields to 5.8.12 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple RCVE-2020-35935 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)
Product
Advanced Access Manager
Fixed in
6.6.2
What to do
Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/aCVE-2020-35934 · WordPress plugins & themes · reported by MITREMedium 4.3
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).
Product
Advanced Access Manager
Fixed in
6.6.2
What to do
Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 31, 2020Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.CVE-2020-20625 · WordPress plugins & themes · reported by MITREHigh 7.5
Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
May 6, 2020A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject aCVE-2020-11727 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.
Product
AlgolPlus Advanced Order Export For WooCommerce
Affected
3.1.3 to 3.1.3
What to do
Affects 3.1.3 to 3.1.3. Update AlgolPlus Advanced Order Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
May 5, 2020Import feature in the wp-advanced-search plugin 3.3.6: Authenticated SQL injectionCVE-2020-12104 · WordPress plugins & themes · reported by MITREHigh 8.8
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
Product
Import feature in the wp-advanced-search plugin 3.3.6
Fixed in
3.3.7
What to do
Update Import feature in the wp-advanced-search plugin 3.3.6 to 3.3.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Apr 24, 2020The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request viaCVE-2020-12070 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.
Product
Advanced Woo Search
Affected
up to 1.99
What to do
Affects up to 1.99. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 4, 2020The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula.CVE-2020-11548 · WordPress plugins & themes · reported by MITRECritical 9.8
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
Product
Search Meter
Affected
up to 2.13.2
What to do
Affects up to 2.13.2. Update Search Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jan 13, 2020WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite VulnerabilityCVE-2014-6059 · WordPress plugins & themes · reported by MITREHigh 7.2
WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability
Fixed in
2.8.2
What to do
Update the plugin to 2.8.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 22, 2019The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.CVE-2015-9501 · WordPress plugins & themes · reported by MITREMedium 6.1
The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.
Product
Artificial Intelligence
Fixed in
1.2.4
What to do
Update Artificial Intelligence to 1.2.4 or newer.
Full record and what to do →NVD record github.com wpvulndb.com
Aug 22, 2019The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.CVE-2018-20986 · WordPress plugins & themes · reported by MITREMedium 5.4
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
Product
advanced-custom-fields (aka Elliot Condon Advanced Custom Fields)
Fixed in
5.7.8
What to do
Update advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) to 5.7.8 or newer.
Full record and what to do →NVD record wordpress.org advancedcustomfields.com
Aug 22, 2019The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.CVE-2016-10929 · WordPress plugins & themes · reported by MITREMedium 5.3
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
Product
advanced-ajax-page-loader
Fixed in
2.7.7
What to do
Update advanced-ajax-page-loader to 2.7.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 29, 2019A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress.CVE-2019-13571 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
Product
A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Jun 19, 2018The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.CVE-2018-11525 · WordPress plugins & themes · reported by MITREHigh 7.8
The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Apr 16, 2018Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.CVE-2018-10100 · WordPress plugins & themes · reported by MITREMedium 6.1
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securitytracker.com codex.wordpress.org
Oct 10, 2016Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8CVE-2016-1000132 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Nov 9, 2015the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4: Cross-site scripting (XSS)CVE-2015-5733 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title.
Product
the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 5, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress allow remote attackers tCVE-2014-9523 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_our_team_member_count parameter in the sc_team_settings page to wp-admin/edit.php.
Product
Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced)
Fixed in
1.3
What to do
Update Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) to 1.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jan 3, 2014Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a CVE-2013-7240 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.
Product
Advanced Dewplayer
What to do
Update Advanced Dewplayer to the newest version.
Full record and what to do →NVD record seclists.org seclists.org
Apr 25, 2013Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers CVE-2013-1949 · WordPress plugins & themes · reported by Red HatMedium 5
Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers to force the upload of arbitrary files.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.sucuri.net it.slashdot.org
Jan 23, 2013Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitraCVE-2011-4618 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Product
Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget
Fixed in
2.0.2
What to do
Update Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget to 2.0.2 or newer.
Full record and what to do →NVD record archives.neohapsis.com plugins.trac.wordpress.org
Mar 5, 2007the ix parameter to wp-includes/feed.php, and: WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers CVE-2007-1277 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
Product
the ix parameter to wp-includes/feed.php, and
What to do
Update the ix parameter to wp-includes/feed.php, and to the newest version.
Full record and what to do →NVD record ifsec.blogspot.com secunia.com
Mar 18, 2006Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unCVE-2006-1263 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
Fixed in
2.0.2
What to do
Update the plugin to 2.0.2 or newer.
Full record and what to do →NVD record wordpress.org securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.