Vulnerability database

96 results · page 1 of 2

• Dec 18, 2025Jack Well: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49365 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Jack Well jack-well allows PHP Local File Inclusion.This issue affects Jack Well: from n/a through <= 1.0.14.

  Product

  Jack Well

  Affected

  up to 1.0.14

  What to do

  Affects up to 1.0.14. Update Jack Well to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 7, 2023Emails & Newsletters with Jackmail: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46821 · WordPress plugins & themes · reported by PatchstackMedium 5.8

  Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.

  Product

  Emails & Newsletters with Jackmail

  Affected

  up to 1.2.22

  What to do

  Affects up to 1.2.22. Update Emails & Newsletters with Jackmail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Sep 14, 2020Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php.CVE-2020-25380 · WordPress plugins & themes · reported by MITREMedium 5.4

  Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.

  Affected

  0.8 to 0.8

  What to do

  Affects 0.8 to 0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com

• Sep 14, 2020Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attackeCVE-2020-25379 · WordPress plugins & themes · reported by MITREHigh 8.8

  Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query.

  Affected

  0.8 to 0.8

  What to do

  Affects 0.8 to 0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com

• Jan 28, 2020Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication ofCVE-2015-5483 · WordPress plugins & themes · reported by MITREHigh 8.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.

  Product

  Private Only

  Affected

  3.5.1 to 3.5.1

  What to do

  Affects 3.5.1 to 3.5.1. Update Private Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comseclists.org

• Apr 6, 2018Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication CVE-2014-5072 · WordPress plugins & themes · reported by MITREHigh 8.8

  Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  Product

  Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log

  Fixed in

  1.2.5

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log to 1.2.5 or newer.

  Full record and what to do →NVD recordgithub.comwpsecurityauditlog.com

• Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the autheCVE-2014-2675 · WordPress plugins & themes · reported by MITREMedium 6.5

  Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete the sitemap via a request to the wp-html-sitemap page in wp-admin/options-general.php.

  Product

  WP HTML Sitemap

  What to do

  Update WP HTML Sitemap to the newest version.

  Full record and what to do →NVD recordsecurity.dxw.comsecurity.dxw.com

• Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication oCVE-2014-2550 · WordPress plugins & themes · reported by MITREHigh 8.8

  Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php.

  Product

  Cross-site request forgery (CSRF) vulnerability in the Disable Comments

  Fixed in

  1.0.4

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the Disable Comments to 1.0.4 or newer.

  Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.dxw.com

• Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the aCVE-2014-2274 · WordPress plugins & themes · reported by MITREHigh 8.8

  Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php.

  Product

  Subscribe To Comments Reloaded

  Fixed in

  140219

  What to do

  Update Subscribe To Comments Reloaded to 140219 or newer.

  Full record and what to do →NVD recordsecurity.dxw.comwordpress.org

• Sep 16, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijackCVE-2015-6965 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) create a field, (2) update a field, (3) delete a field, (4) create a form, (5) update a form, (6) delete a form, (7) create a template, (8) update a template, (9) delete a template, or (10) conduct cross-site scripting (XSS) attacks via a crafted request to the cfg_forms page in wp-admin/admin.php.

  Product

  Contact Form Generator

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Contact Form Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com

• Aug 19, 2015Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of adminiCVE-2015-6523 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.

  Product

  Cross-site request forgery (CSRF) vulnerability in the Portfolio

  Fixed in

  1.05

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the Portfolio to 1.05 or newer.

  Full record and what to do →NVD recordseclists.orgplugins.trac.wordpress.org

• Jun 18, 2015Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for CVE-2015-4140 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.

  Product

  WP Smiley

  Affected

  1.4.1 to 1.4.1

  What to do

  Affects 1.4.1 to 1.4.1. Update WP Smiley to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordopenwall.comopenwall.com

• Jun 9, 2015Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authenticatiCVE-2015-4010 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the iframe_url parameter in an Update Page action in the conformconf page to wp-admin/options-general.php.

  Product

  Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form

  Fixed in

  1.1

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form to 1.1 or newer.

  Full record and what to do →NVD recordmarc.infopacketstormsecurity.com

• Apr 1, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijackCVE-2015-2755 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameter in the ab_map_options page to wp-admin/admin.php.

  Product

  Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP)

  Fixed in

  4.0

  What to do

  Update Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) to 4.0 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Mar 6, 2015Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack theCVE-2015-0895 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.

  Product

  Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall

  Fixed in

  3.9.0

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall to 3.9.0 or newer.

  Full record and what to do →NVD recordjvn.jpjvndb.jvn.jp

• Feb 25, 2015Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication CVE-2015-2084 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit action in the cnss_social_icon_add page to wp-admin/admin.php.

  Product

  Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons

  Fixed in

  1.2.3

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons to 1.2.3 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comseclists.org

• Feb 20, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the CVE-2015-2039 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.

  Product

  Acobot Live Chat & Contact Form

  Affected

  2.0 to 2.0

  What to do

  Affects 2.0 to 2.0. Update Acobot Live Chat & Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Feb 19, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authenticatiCVE-2015-1614 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) image_metadata_cruncher[alt] or (2) image_metadata_cruncher[caption] parameter in an update action in the image_metadata_cruncher_title page to wp-admin/options.php or (3) custom image meta tag to the image metadata cruncher page.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

• Feb 11, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication oCVE-2015-1581 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php.

  Product

  Mobile Domain

  Affected

  1.5.2 to 1.5.2

  What to do

  Affects 1.5.2 to 1.5.2. Update Mobile Domain to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Feb 11, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication CVE-2015-1580 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) source or (3) redir parameter in an add action in the redirection-page to wp-admin/options-general.php.

  Product

  Redirection Page

  Affected

  1.2 to 1.2

  What to do

  Affects 1.2 to 1.2. Update Redirection Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Jan 15, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of adCVE-2014-7957 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the toggled parameter in a toggle action in the pods-components page to wp-admin/admin.php, (2) delete a pod in a delete action in the pods page to wp-admin/admin.php, (3) reset pod settings and data via the pods_reset parameter in the pod-settings page to wp-admin/admin.php, (4) deactivate and reset pod data via the pods_reset_deactivate parameter in the pod-settings page to wp-admin/admin.php, (5) delete the admin role via the id parameter in a delete action in the pods-component-roles-and-capabilities page to wp-admin/admin.php, or (6) enable "roles and capabilities" in a toggle action in the pods-components page to wp-admin/admin.php.

  Product

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods

  Fixed in

  2.5

  What to do

  Update Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods to 2.5 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comseclists.org

• Jan 13, 2015Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentCVE-2014-100001 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information.

  Product

  Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim

  Fixed in

  1.1.4-free

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim to 1.1.4-free or newer.

  Full record and what to do →NVD recordsecunia.comexchange.xforce.ibmcloud.com

• Jan 12, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication CVE-2014-2838 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct (1) SQL injection attacks via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php or (2) cross-site scripting (XSS) attacks via unspecified vectors.

  Product

  GD Star Rating

  Affected

  19.22 to 19.22

  What to do

  Affects 19.22 to 19.22. Update GD Star Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordseclists.orgsecunia.com

• Jan 8, 2015Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of aCVE-2015-0920 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the BannerEffectOptions page to wp-admin/options-general.php.

  Product

  Banner Effect Header

  Affected

  1.2.6 to 1.2.6

  What to do

  Affects 1.2.6 to 1.2.6. Update Banner Effect Header to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Jan 5, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the autCVE-2014-9525 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_popup_subtitle parameter in the wp-popup.php page to wp-admin/options-general.php.

  Product

  Timed Popup (wp-timed-popup)

  What to do

  Update Timed Popup (wp-timed-popup) to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Jan 5, 2015Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentiCVE-2014-2598 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the quickppr_redirects[request][] parameter in the redirect-updates page to wp-admin/admin.php.

  Product

  Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect

  Fixed in

  5.0.5

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect to 5.0.5 or newer.

  Full record and what to do →NVD recordosvdb.orgosvdb.org

• Jan 2, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hijack the authenticatCVE-2014-9460 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) vgb_page or (3) vgb_items_per_pg parameter in the wp-vipergb page to wp-admin/options-general.php.

  Product

  Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB

  Fixed in

  1.3.11

  What to do

  Update Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB to 1.3.11 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Jan 2, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer plugin before 1.3.3 for WordPress allow remote attackers to hijack the auCVE-2014-9454 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer plugin before 1.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) simple_sf_width or (3) simple_sf_style parameter in the simple-simple-sticky-footer page to wp-admin/themes.php.

  Product

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer

  Fixed in

  1.3.3

  What to do

  Update Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer to 1.3.3 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Jan 2, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authenticCVE-2014-9441 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) ll__opt[image2_url] or (3) ll__opt[image3_url] parameter in a ll_save_settings action to wp-admin/admin-ajax.php.

  Product

  Lightbox Photo Gallery

  Affected

  1.0 to 1.0

  What to do

  Affects 1.0 to 1.0. Update Lightbox Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Jan 2, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authenticaCVE-2014-9437 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_social_slider_margin parameter in a wpbs_save_settings action in the wpbs_panel page to wp-admin/admin.php.

  Product

  Sliding Social Icons

  Affected

  1.61 to 1.61

  What to do

  Affects 1.61 to 1.61. Update Sliding Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Dec 31, 2014Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the aCVE-2014-9401 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the lpa_post_letters parameter in the wp-limit-posts-automatically.php page to wp-admin/options-general.php.

  Product

  WP Limit Posts Automatically

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update WP Limit Posts Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Dec 31, 2014Cross-site request forgery (CSRF) vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack the authentication of CVE-2014-9399 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the tweetscribe_username parameter in a save action in the tweetscribe.php page to wp-admin/options-general.php.

  Product

  TweetScribe

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update TweetScribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Dec 31, 2014Cross-site request forgery (CSRF) vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hijack the authenticatCVE-2014-9398 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the mashtlb_twitter_username parameter in the twitter-liveblog.php page to wp-admin/options-general.php.

  Product

  Twitter LiveBlog

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Twitter LiveBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Dec 31, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleFlickr plugin 3.0.3 and earlier for WordPress allow remote attackers to hijack the autheCVE-2014-9396 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleFlickr plugin 3.0.3 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) simpleflickr_width, (2) simpleflickr_bgcolor, or (3) simpleflickr_xmldatapath parameter in the simpleFlickr.php page to wp-admin/options-general.php.

  Product

  SimpleFlickr

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update SimpleFlickr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Dec 31, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Simplelife plugin 1.2 and earlier for WordPress allow remote attackers to hijack the authenticCVE-2014-9395 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Simplelife plugin 1.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) simplehoverback, (2) simplehovertext, (3) flickrback, or (4) simple_flimit parameter in the simplelife.php page to wp-admin/options-general.php.

  Product

  Simplelife

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Simplelife to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Dec 31, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the PWGRandom plugin 1.11 and earlier for WordPress allow remote attackers to hijack the authenticCVE-2014-9394 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the PWGRandom plugin 1.11 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) pwgrandom_title or (2) pwgrandom_category parameter in the pwgrandom page to wp-admin/options-general.php.

  Product

  PWGRandom

  Affected

  up to 1.11

  What to do

  Affects up to 1.11. Update PWGRandom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Dec 31, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attackers to hijack the authCVE-2014-9393 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) idptt_twitter_username or (2) idptt_tweet_prefix parameter to wp-admin/options-general.php.

  Product

  Post to Twitter

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update Post to Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Dec 31, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the gSlideShow plugin 0.1 and earlier for WordPress allow remote attackers to hijack the authenticCVE-2014-9391 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the gSlideShow plugin 0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) rss, (2) display_time or (3) transistion_time parameter in the gslideshow.php page to wp-admin/options-general.php.

  Product

  gSlideShow

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update gSlideShow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Dec 24, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the IP Ban (simple-ip-ban) plugin 1.2.3 for WordPress allow remote attackers to hijack the authentCVE-2014-9413 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the IP Ban (simple-ip-ban) plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) ip_list, (2) user_agent_list, or (3) redirect_url parameter in the simple-ip-ban page to wp-admin/options-general.php.

  Product

  IP Ban (simple-ip-ban)

  Affected

  1.2.3 to 1.2.3

  What to do

  Affects 1.2.3 to 1.2.3. Update IP Ban (simple-ip-ban) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Dec 24, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of CVE-2014-9334 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) user or (2) password parameter in the bird-feeder page to wp-admin/options-general.php.

  Product

  Bird Feeder

  Affected

  1.2.3 to 1.2.3

  What to do

  Affects 1.2.3 to 1.2.3. Update Bird Feeder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comseclists.org

• Dec 19, 2014Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of CVE-2014-9368 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the username_twitterDash parameter in the twitterDash.php page to wp-admin/options-general.php.

  Product

  twitterDash

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update twitterDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers to hijack the authentCVE-2014-9341 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) yurl_login or (2) yurl_anchor parameter in the yurl page to wp-admin/options-general.php.

  Product

  yURL ReTwitt

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update yURL ReTwitt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authenCVE-2014-9340 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the wpCommentTwit.php page to wp-admin/options-general.php.

  Product

  wpCommentTwit

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update wpCommentTwit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to hijack the authentiCVE-2014-9339 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the spnbabble.php page to wp-admin/options-general.php.

  Product

  SPNbabble

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update SPNbabble to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to hijack the authenticaCVE-2014-9338 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) o2t_username or (2) o2t_tags parameter to wp-admin/options-general.php.

  Product

  O2Tweet

  Affected

  up to 0.0.4

  What to do

  Affects up to 0.0.4. Update O2Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to hijack the authenticaCVE-2014-9336 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) itex_t_twitter_username or (2) itex_t_twitter_userpass parameter in the iTwitter.php page to wp-admin/options-general.php.

  Product

  iTwitter

  Affected

  up to 0.04

  What to do

  Affects up to 0.04. Update iTwitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comseclists.org

• Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the aCVE-2014-9335 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) email_address or (2) sidebarTitle parameter in the dandyid-services.php page to wp-admin/options-general.php.

  Product

  DandyID Services

  Affected

  up to 1.5.9

  What to do

  Affects up to 1.5.9. Update DandyID Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Dec 5, 2014Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack thCVE-2014-9129 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the addons_title parameter in the CMDM_admin_settings page to wp-admin/admin.php.

  Product

  Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager

  Fixed in

  2.0.7

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager to 2.0.7 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

• Nov 26, 2014Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of adminiCVE-2014-9099 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydowork_adsense page in wp-admin/options-general.php.

  Product

  WhyDoWork AdSense

  Affected

  1.2 to 1.2

  What to do

  Affects 1.2 to 1.2. Update WhyDoWork AdSense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

• Nov 16, 2014Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authenticatCVE-2014-8948 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter. NOTE: this can be leveraged with CVE-2014-8948 to execute arbitrary commands.

  Product

  Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012

  Affected

  up to 3.9.001

  What to do

  Affects up to 3.9.001. Update Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.