WordPress CVEs

CVE-2014-8335 January 5, 2018

(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the… Full details

HIGH 7.8

CVE-2018-5214 January 4, 2018

The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php. Full details

MEDIUM 5.4

CVE-2018-5213 January 4, 2018

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php. Full details

MEDIUM 5.4

CVE-2018-5212 January 4, 2018

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php. Full details

MEDIUM 5.4

CVE-2017-1000434 January 2, 2018

Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker controlled page classes/Furigana.php: header('location:'.urldecode($_GET['furikake-redirect'])); Full details

MEDIUM 6.1

CVE-2017-18015 January 2, 2018

The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter. Full details

MEDIUM 6.1

CVE-2017-18012 January 1, 2018

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter. Full details

MEDIUM 6.1

CVE-2017-18011 January 1, 2018

The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter. Full details

MEDIUM 6.1

CVE-2017-18010 January 1, 2018

The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter. Full details

MEDIUM 6.1

CVE-2018-3811 January 1, 2018

SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords() function in smartgooglecode.php… Full details

CRITICAL 9.8

CVE-2018-3810 January 1, 2018

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages… Full details

CRITICAL 9.8

CVE-2015-3302 December 29, 2017

The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism." Full details

HIGH 7.5

CVE-2015-7669 December 27, 2017

Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to "upload… Full details

CRITICAL 9.8

CVE-2015-7668 December 27, 2017

Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter. Full details

MEDIUM 6.1

CVE-2015-7667 December 27, 2017

Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter. Full details

MEDIUM 6.1

CVE-2015-7666 December 27, 2017

Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web… Full details

MEDIUM 6.1

CVE-2017-17869 December 27, 2017

The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter. Full details

MEDIUM 6.1

CVE-2011-4955 December 20, 2017

Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s or (2) p… Full details

MEDIUM 6.1

CVE-2017-17780 December 20, 2017

The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications… Full details

MEDIUM 6.1

CVE-2017-17753 December 19, 2017

Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cie_type, (2) cie_import, (3) cie_update, or (4) cie_ignore… Full details

MEDIUM 6.1

CVE-2017-17744 December 19, 2017

A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter to view/advancedsettings.php. Full details

MEDIUM 6.1

CVE-2017-17719 December 19, 2017

A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the result_message parameter to includes/concours_page.php. Full details

MEDIUM 6.1

CVE-2017-16949 December 19, 2017

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size,… Full details

CRITICAL 9.8

CVE-2017-17451 December 7, 2017

The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php. Full details

MEDIUM 6.1

CVE-2017-17096 December 3, 2017

Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via crafted OpenGraph data. Full details

MEDIUM 6.1

CVE-2017-17094 December 2, 2017

wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL. Full details

MEDIUM 5.4

CVE-2017-17093 December 2, 2017

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site. Full details

MEDIUM 5.4

CVE-2017-17092 December 2, 2017

wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file. Full details

MEDIUM 5.4

CVE-2017-17091 December 2, 2017

wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string. Full details

HIGH 8.8

CVE-2017-17059 November 29, 2017

XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php. Full details

MEDIUM 6.1

CVE-2017-17058 November 29, 2017

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all… Full details

HIGH 7.5

CVE-2017-17043 November 28, 2017

The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly. Full details

MEDIUM 6.1

CVE-2017-16955 November 27, 2017

SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via the "keyword" parameter to /wp-admin/options-general.php?page=inlinks/inlinks.php. Full details

HIGH 8.8

CVE-2017-1000227 November 17, 2017

Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can Full details

MEDIUM 5.4

CVE-2017-16871 November 17, 2017

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor… Full details

HIGH 8.1

CVE-2017-16870 November 17, 2017

The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary Full details

HIGH 8.1

CVE-2017-16842 November 16, 2017

Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML. Full details

MEDIUM 4.8

CVE-2017-16815 November 14, 2017

installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-content/plugins/duplicator/installer/build/view.step4.php) and "logging" (wp-content/plugins/duplicator/installer/build/view.step2.php) are not filtered correctly. Full details

MEDIUM 6.1

CVE-2017-16562 November 10, 2017

The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter… Full details

CRITICAL 9.8

CVE-2017-16758 November 9, 2017

Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "access_token" parameter. Full details

MEDIUM 4.8

CVE-2017-16510 November 2, 2017

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a… Full details

CRITICAL 9.8

CVE-2017-15919 October 26, 2017

The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php. Full details

CRITICAL 9.8

CVE-2017-15867 October 24, 2017

Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, (3) user_id, (4) username, (5)… Full details

MEDIUM 6.1

CVE-2017-15863 October 24, 2017

Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php. Full details

MEDIUM 6.1

CVE-2015-5533 October 23, 2017

SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpd_keep_month parameter to wp-admin/options-general.php. NOTE: this can be… Full details

HIGH 7.2

CVE-2015-5532 October 23, 2017

Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2)… Full details

MEDIUM 6.1

CVE-2017-15812 October 23, 2017

The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel. Full details

MEDIUM 6.1

CVE-2017-15811 October 23, 2017

The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php. Full details

MEDIUM 5.4

CVE-2017-15810 October 23, 2017

The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php. Full details

MEDIUM 6.1

CVE-2015-6668 October 19, 2017

The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference. Full details

HIGH 7.5