Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

545new WordPress flaws this week

391,964entries in the database

5,770 results · page 92 of 116

Jun 10, 2019An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress.CVE-2019-9880 · WordPress plugins & themes · reported by MITRECritical 9.1
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
Affected
0.2.3 to 0.2.3
What to do
Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 10, 2019The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed.CVE-2019-9879 · WordPress plugins & themes · reported by MITRECritical 9.8
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.
Affected
0.2.3 to 0.2.3
What to do
Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 3, 2019The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.CVE-2019-11185 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
Product
WP Live Chat Support Pro
Affected
up to 8.0.26
What to do
Affects up to 8.0.26. Update WP Live Chat Support Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wp-livechat.com
Jun 2, 2019The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php.CVE-2019-12566 · WordPress plugins & themes · reported by MITREMedium 5.4
The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user.
Product
WP Statistics
Affected
up to 12.6.5
What to do
Affects up to 12.6.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
May 29, 2019Hustle (aka wordpress-popup) plugin 6.0.7: CSV Injection as it allows for injecting malicious code into a pop-up windowCVE-2019-11872 · WordPress plugins & themes · reported by MITREHigh 8.8
The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the plugin does not sanitize the user's input and allows insertion of any text.
Product
Hustle (aka wordpress-popup) plugin 6.0.7
Fixed in
6.0.8.1
What to do
Update Hustle (aka wordpress-popup) plugin 6.0.7 to 6.0.8.1 or newer.
Full record and what to do →NVD record blog.reddy.io blog.reddy.io
May 27, 2019XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress.CVE-2019-12345 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress.
Product
XSS exists in the Kiboko Hostel
Fixed in
1.1.4
What to do
Update XSS exists in the Kiboko Hostel to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
May 23, 2019In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/CVE-2019-10866 · WordPress plugins & themes · reported by MITRECritical 9.8
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
Product
In the Form Maker
Fixed in
1.13.3
What to do
Update In the Form Maker to 1.13.3 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
May 20, 2019The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.CVE-2019-12241 · WordPress plugins & themes · reported by MITRECritical 9.8
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.
Affected
1.4.5 to 1.4.5
What to do
Affects 1.4.5 to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record dumpco.re wpvulndb.com
May 20, 2019The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.CVE-2019-12240 · WordPress plugins & themes · reported by MITRECritical 9.8
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.
Affected
0.4 to 0.4
What to do
Affects 0.4 to 0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record dumpco.re wpvulndb.com
May 20, 2019The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrativCVE-2019-12239 · WordPress plugins & themes · reported by MITREHigh 7.2
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
Fixed in
1.5.2
What to do
Update the plugin to 1.5.2 or newer.
Full record and what to do →NVD record dumpco.re wordpress.org
May 13, 2019The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.CVE-2019-9618 · WordPress plugins & themes · reported by MITRECritical 9.8
The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
May 13, 2019Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web scripCVE-2019-7411 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL).
Product
MyThemeShop Launcher
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update MyThemeShop Launcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record metamorfosec.com wpvulndb.com
May 13, 2019The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or CVE-2018-18872 · WordPress plugins & themes · reported by MITREMedium 5.4
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI.
Product
Kieran O'Shea Calendar
Fixed in
1.3.11
What to do
Update Kieran O'Shea Calendar to 1.3.11 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
May 13, 2019pageflipbook.php script from index.php in Page Flip Book plugin for: Directory traversalCVE-2012-6652 · WordPress plugins & themes · reported by MITRECritical 9.8
Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pageflipbook_language parameter.
Product
pageflipbook.php script from index.php in Page Flip Book plugin for
What to do
Update pageflipbook.php script from index.php in Page Flip Book plugin for to the newest version.
Full record and what to do →NVD record ceriksen.com wordpress.org
May 13, 2019The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstratCVE-2019-11886 · WordPress plugins & themes · reported by MITREHigh 8.8
The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.
Product
WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer)
Fixed in
7.2.1
What to do
Update WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) to 7.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
May 13, 2019ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.CVE-2018-20838 · WordPress plugins & themes · reported by MITREMedium 5.4
ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.
Product
ampforwp_save_steps_data in the AMP for WP
Fixed in
0.9.97.21
What to do
Update ampforwp_save_steps_data in the AMP for WP to 0.9.97.21 or newer.
Full record and what to do →NVD record ampforwp.com plugins.trac.wordpress.org
May 9, 2019The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.CVE-2019-11871 · WordPress plugins & themes · reported by MITREMedium 5.4
The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.
Product
Custom Field Suite
Fixed in
2.5.15
What to do
Update Custom Field Suite to 2.5.15 or newer.
Full record and what to do →NVD record blog.reddy.io wordpress.org
May 9, 2019The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (itCVE-2019-11869 · WordPress plugins & themes · reported by MITREMedium 6.1
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.
Affected
5.12.94 to 5.12.94
What to do
Affects 5.12.94 to 5.12.94. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com pluginvulnerabilities.com
May 7, 2019The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files,CVE-2018-19456 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files, as demonstrated by download.sql.
Product
WP Backup+ (aka WPbackupplus)
Affected
up to 2018-11-22
What to do
Affects up to 2018-11-22. Update WP Backup+ (aka WPbackupplus) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.opensuse.org easyhack.in
May 7, 2019Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated).CVE-2019-10869 · WordPress plugins & themes · reported by MITREHigh 8.1
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
Product
Path Traversal and Unrestricted File Upload exists in the Ninja Forms
Fixed in
3.0.23
What to do
Update Path Traversal and Unrestricted File Upload exists in the Ninja Forms to 3.0.23 or newer.
Full record and what to do →NVD record wpscan.com wpvulndb.com
May 6, 2019The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_defaulCVE-2019-11807 · WordPress plugins & themes · reported by MITREHigh 7.5
The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_default_keys_load parameter because of a nopriv_ registration and a lack of capabilities checks.
Product
WooCommerce Checkout Manager
Fixed in
4.3
What to do
Update WooCommerce Checkout Manager to 4.3 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
May 1, 2019HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fakCVE-2019-11633 · WordPress plugins & themes · reported by MITREHigh 7.5
HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fake WordPress templates. This allows attackers to discover and avoid this honeypot system.
Affected
up to 2016-09-27
What to do
Affects up to 2016-09-27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Apr 29, 2019The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion CVE-2019-11591 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form
Fixed in
1.13.5
What to do
Update WebDorado Contact Form to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 29, 2019The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via diCVE-2019-11590 · WordPress plugins & themes · reported by MITREHigh 8.8
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
10Web Form Maker
Fixed in
1.13.5
What to do
Update 10Web Form Maker to 1.13.5 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 27, 2019Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.CVE-2019-11565 · WordPress plugins & themes · reported by MITRECritical 9.8
Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.
Product
Server Side Request Forgery (SSRF) exists in the Print My Blog
Fixed in
1.6.7
What to do
Update Server Side Request Forgery (SSRF) exists in the Print My Blog to 1.6.7 or newer.
Full record and what to do →NVD record dumpco.re github.com
Apr 26, 2019The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inCVE-2019-11557 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Product
WebDorado Contact Form Builder
Fixed in
1.0.69
What to do
Update WebDorado Contact Form Builder to 1.0.69 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Apr 25, 2019The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector.CVE-2019-9669 · WordPress plugins & themes · reported by MITREMedium 6.1
The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn't make a WordPress site vulnerable (speaking in terms of software vulnerabilities)
Product
Wordfence
Affected
7.2.3 to 7.2.3
What to do
Affects 7.2.3 to 7.2.3. Update Wordfence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record edgescan.com edgescan.com
Apr 23, 2019The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GETCVE-2019-10864 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
Product
WP Statistics
Affected
up to 12.6.2
What to do
Affects up to 12.6.2. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com medium.com
Apr 18, 2019An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading CVE-2019-11223 · WordPress plugins & themes · reported by MITRECritical 9.8
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Product
An Unrestricted File Upload Vulnerability in the SupportCandy
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update An Unrestricted File Upload Vulnerability in the SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.kalasag.com.ph wordpress.org
Apr 15, 2019XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_CVE-2018-18019 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter.
Product
Tribulant Slideshow Gallery
Affected
1.6.8 to 1.6.8
What to do
Affects 1.6.8 to 1.6.8. Update Tribulant Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 15, 2019SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] oCVE-2018-18018 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
Product
Tribulant Slideshow Gallery
Affected
1.6.8 to 1.6.8
What to do
Affects 1.6.8 to 1.6.8. Update Tribulant Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 15, 2019XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[CVE-2018-18017 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
Product
Tribulant Slideshow Gallery
Affected
1.6.8 to 1.6.8
What to do
Affects 1.6.8 to 1.6.8. Update Tribulant Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 15, 2019There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.CVE-2018-16967 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
Product
mndpsingh287 File Manager
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update mndpsingh287 File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com wordpress.org
Apr 15, 2019There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.CVE-2018-16966 · WordPress plugins & themes · reported by MITREHigh 8.8
There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
Product
mndpsingh287 File Manager
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update mndpsingh287 File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com wordpress.org
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.CVE-2018-17586 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.
Affected
0.8.8.5 to 0.8.8.5
What to do
Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter.CVE-2018-17585 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter.
Affected
0.8.8.5 to 0.8.8.5
What to do
Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page.CVE-2018-17584 · WordPress plugins & themes · reported by MITREHigh 8.8
The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page.
Affected
0.8.8.5 to 0.8.8.5
What to do
Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.CVE-2018-17583 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.
Affected
0.8.8.5 to 0.8.8.5
What to do
Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16259 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16258 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template.CVE-2018-16257 · WordPress plugins & themes · reported by MITREMedium 6.1
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16256 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16255 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019WP All Import plugin 3.4.9 for: There is an XSSCVE-2018-16254 · WordPress plugins & themes · reported by MITREMedium 6.1
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Product
WP All Import plugin 3.4.9 for
Affected
3.4.9 to 3.4.9
What to do
Affects 3.4.9 to 3.4.9. Update WP All Import plugin 3.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com docs.google.com
Apr 12, 2019The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-maCVE-2018-13137 · WordPress plugins & themes · reported by MITREMedium 4.8
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
Affected
5.9.4 to 5.9.4
What to do
Affects 5.9.4 to 5.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ansawaf.blogspot.com gist.github.com
Apr 9, 2019The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function.CVE-2019-6117 · WordPress plugins & themes · reported by MITREMedium 6.1
The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function.
Affected
1.6.14 to 1.6.14
What to do
Affects 1.6.14 to 1.6.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record earthmanet.github.io earthmanet.github.io
Apr 3, 2019A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsCVE-2019-10673 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.
Product
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member
Fixed in
2.0.40
What to do
Update A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Apr 2, 2019In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.CVE-2019-10692 · WordPress plugins & themes · reported by MITRECritical 9.8
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.
Product
In the wp-google-maps
Fixed in
7.11.18
What to do
Update In the wp-google-maps to 7.11.18 or newer.
Full record and what to do →NVD record packetstormsecurity.com rapid7.com
Apr 1, 2019pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionCoCVE-2019-6715 · WordPress plugins & themes · reported by MITREHigh 7.5
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.
Product
pub/sns.php in the W3 Total Cache
Fixed in
0.9.4
What to do
Update pub/sns.php in the W3 Total Cache to 0.9.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com vinhjaxt.github.io
Mar 27, 2019An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27.CVE-2019-1010257 · WordPress plugins & themes · reported by josh@bress.netCritical 9.1
An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can be downloaded. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.
Product
article2pdf
Fixed in
5.3
What to do
Update article2pdf to 5.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.