CVEs published in August 2019
2,040 vulnerabilities, 318 critical, 7 exploited.
- payeezy wp payeezy payThe wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate...9.8 Critical
- getshortcodes shortcodes ultimateThe shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter...9.8 Critical
- wpmadeasy shortcode factoryThe shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.9.8 Critical
- patreon wordpressThe patreon-connect plugin before 1.2.2 for WordPress has Object Injection.9.8 Critical
- optiontree project optiontreeThe option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes...9.8 Critical
- optiontree project optiontreeThe option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is...9.8 Critical
- optiontree project optiontreeThe option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.9.8 Critical
- neliosoftware nelio ab testingThe nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.10.0 Critical
- neliosoftware nelio ab testingThe nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.10.0 Critical
- memphis documents library project documents libraryThe memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.6.1 Medium
- memphis documents library project documents libraryThe memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.9.8 Critical
- memphis documents library project documents libraryThe memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.9.8 Critical
- meowapps wp retina 2xThe wp-retina-2x plugin before 5.2.3 for WordPress has XSS.6.1 Medium
- tubepressThe tubepress plugin before 1.6.5 for WordPress has XSS.6.1 Medium
- reflex gallery project galleryThe reflex-gallery plugin before 1.4.3 for WordPress has XSS.6.1 Medium
- profilepress loginwpThe peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of...6.1 Medium
- ibericode mailchimp for wordpressThe mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of...6.1 Medium
- zedna ebook download project ebook downloadThe ebook-download plugin before 1.2 for WordPress has directory traversal.7.5 High
- event notifier project notifierThe event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.6.1 Medium
- visser store toolkit for woocommerceThe woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.9.8 Critical
- visser store toolkit for woocommerceThe woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.9.8 Critical
- newstatpress project newstatpressThe newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.6.1 Medium
- davidlingren media library assistantThe media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or...6.1 Medium
- bestwebsoft contact formThe contact-form-plugin plugin before 3.3.5 for WordPress has XSS.6.1 Medium
- yikesinc easy forms for mailchimpThe yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via...9.8 Critical
- ninjaforms ninja formsThe ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.6.1 Medium
- ninjaforms ninja formsThe ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission...9.1 Critical
- sumo google analyticatorThe google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for...6.1 Medium
- ninjaforms ninja formsThe ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.7.5 High
- rocklobster contact form 7The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of...9.8 Critical
- simplerealtytheme simple login logThe simple-login-log plugin before 1.1.2 for WordPress has SQL injection.9.8 Critical
- ays-pro photo galleryThe gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.9.8 Critical
- sir gnucommerceThe gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.6.1 Medium
- sir gnucommerceThe gnucommerce plugin before 1.4.2 for WordPress has XSS.6.1 Medium
- pixelite events managerThe events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.6.1 Medium
- pixelite events managerThe events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.6.1 Medium
- pixelite events managerThe events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.6.1 Medium
- pixelite events managerThe events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.6.1 Medium
- sphinxsearch sphinxSphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making...7.5 High
- pixelite events managerThe events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.6.1 Medium
- wassup real time analytics project real time analyticsThe wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI:...6.1 Medium
- supsystic photo galleryThe gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.8.8 High
- givewpThe give plugin before 2.4.7 for WordPress has XSS via a donor name.5.4 Medium
- codection clean loginThe clean-login plugin before 1.5.1 for WordPress has reflected XSS.6.1 Medium
- search everything project everythingThe search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4...9.8 Critical
- search everything project everythingThe search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search...9.8 Critical
- bestwebsoft limit attemptsThe limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.9.8 Critical
- tiki tikiwiki cms\/groupwaretiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is...5.4 Medium
- cformsii project cformsiiThe cforms2 plugin before 14.6.10 for WordPress has SQL injection.9.8 Critical
- cformsii project cformsiiThe cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete...9.8 Critical
- Show moreLoading…