Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
413 results · page 9 of 9
Jul 9, 2020In TimelineJS before version 3.7.0, some user data renders as HTML.CVE-2020-15092 · WordPress plugins & themes · reported by GitHubHigh 7.2
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most TimelineJS users configure their timeline with a Google Sheets document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if they grant public write access to the document. Some TimelineJS users configure their timeline with a JSON document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if write access to the system hosting that document is otherwise compromised. Version 3.7.0 of TimelineJS addresses this in two ways. For content which is intended to support limited HTML markup for styling and linking, that content is "sanitized" before being added to the DOM. For content intended for simple text display, all markup is stripped. Very few users
- Product
- code. Some users of TimelineJS use it as a part of a
- What to do
- Update code. Some users of TimelineJS use it as a part of a to the newest version.
Full record and what to do →NVD recordgithub.comknightlab.northwestern.edu
Sep 13, 2019The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.CVE-2016-10945 · WordPress plugins & themes · reported by MITREHigh 8.8
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2019The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.CVE-2017-18537 · WordPress plugins & themes · reported by MITREMedium 6.1
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
- Product
- visitors-online
- Fixed in
- 1.0.0
- What to do
- Update visitors-online to 1.0.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 16, 2019The visitors-online plugin before 0.4 for WordPress has SQL injection.CVE-2015-9325 · WordPress plugins & themes · reported by MITRECritical 9.8
The visitors-online plugin before 0.4 for WordPress has SQL injection.
- Product
- visitors-online
- Fixed in
- 0.4
- What to do
- Update visitors-online to 0.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jul 5, 2019Online Lesson Booking 0.8.6 and earlier: Cross-site request forgery (CSRF)CVE-2019-5973 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- Online Lesson Booking 0.8.6 and earlier
- Affected
- up to 0.8.6
- What to do
- Affects up to 0.8.6. Update Online Lesson Booking 0.8.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 5, 2019Online Lesson Booking 0.8.6 and earlier: Cross-site scriptingCVE-2019-5972 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Online Lesson Booking 0.8.6 and earlier
- Affected
- up to 0.8.6
- What to do
- Affects up to 0.8.6. Update Online Lesson Booking 0.8.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 28, 2017Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) tCVE-2017-14507 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php or (3) pages/content_timeline_index.php.
- Product
- Content Timeline
- Affected
- 4.4.2 to 4.4.2
- What to do
- Affects 4.4.2 to 4.4.2. Update Content Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comexploit-db.com
Oct 10, 2016Reflected XSS in wordpress plugin defa-online-image-protector v3.3CVE-2016-1000129 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin defa-online-image-protector v3.3
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain seCVE-2014-8607 · WordPress plugins & themes · reported by MITRELow 2.1
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command.
- Affected
- 3.1.1 to 3.1.1
- What to do
- Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapid.dhs.orgvapid.dhs.org
Aug 6, 2014SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute aCVE-2014-5184 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the story parameter in an edit action to wp-admin/admin.php.
- Product
- stripShow
- Affected
- 2.5.2 to 2.5.2
- What to do
- Affects 2.5.2 to 2.5.2. Update stripShow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for WordPress allow remoCVE-2014-4547 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) tags or (2) search_for parameter.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking
- Fixed in
- 1.8.2
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking to 1.8.2 or newer.
Full record and what to do →NVD recordcodevigilant.complugins.trac.wordpress.org
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow reCVE-2014-4513 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter.
- Product
- ActiveHelper LiveHelp Live Chat
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update ActiveHelper LiveHelp Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sCVE-2011-3863 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
- Product
- Cross-site scripting (XSS) vulnerability in the RedLine
- Fixed in
- 1.66
- What to do
- Update Cross-site scripting (XSS) vulnerability in the RedLine to 1.66 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.