Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
552 results · page 10 of 12
Apr 10, 2023WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Fixed in
- 2.7.9.4
- What to do
- Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to 2.7.9.4 or newer.
Mar 13, 2023FluentSMTP: Does not sanitize or escape email contentCVE-2023-0219 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.
- Product
- FluentSMTP
- Fixed in
- 2.2.3
- What to do
- Update FluentSMTP to 2.2.3 or newer.
Feb 12, 2023A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress.CVE-2015-10078 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress. This issue affects the function send_welcome_email_url of the file resend-welcome-email.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is b14c1f66d307783f0ae74f88088a85999107695c. It is recommended to upgrade the affected component. The identifier VDB-220637 was assigned to this vulnerability.
- Affected
- 1.0.1 to 1.0.1
- What to do
- Affects 1.0.1 to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Cloak Front End Email: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Cloak Front End Email
- Fixed in
- 1.9.2
- What to do
- Update Cloak Front End Email to 1.9.2 or newer.
Jan 2, 2023Visual Email Designer for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3860 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author.
- Product
- Visual Email Designer for WooCommerce
- Fixed in
- 1.7.2
- What to do
- Update Visual Email Designer for WooCommerce to 1.7.2 or newer.
Dec 26, 2022Bulk Delete Users by Email: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4267 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Bulk Delete Users by Email
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bulk Delete Users by Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Bulk Delete Users by Email: Does not have CSRF checkCVE-2022-4266 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete non admin users by knowing their email via a CSRF attack
- Product
- Bulk Delete Users by Email
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bulk Delete Users by Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3858 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin.
- Product
- Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button
- Fixed in
- 3.0.3
- What to do
- Update Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button to 3.0.3 or newer.
Oct 25, 2022Kadence WooCommerce Email Designer: Unserialises the content of an imported fileCVE-2022-3335 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Kadence WooCommerce Email Designer
- Fixed in
- 1.5.7
- What to do
- Update Kadence WooCommerce Email Designer to 1.5.7 or newer.
Oct 21, 2022Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder: Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email)CVE-2022-38104 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.
- Product
- Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 26, 2022Post SMTP Mailer/Email Log: Does not have proper authorisation in some AJAX actionsCVE-2022-2352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.7
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.7 or newer.
Sep 16, 2022Post SMTP Mailer/Email Log: Does not escape some of its settings before outputting them in the admins dashboardCVE-2022-2351 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.4
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.4 or newer.
Sep 5, 2022The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticatedCVE-2022-2376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
- Product
- Directorist
- Fixed in
- 7.3.1
- What to do
- Update Directorist to 7.3.1 or newer.
Aug 22, 2022Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami: Does not have authorisation and CSRF checks in one of its AJAX actionCVE-2022-2389 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations
- Product
- Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami
- Fixed in
- 2.1.2
- What to do
- Update Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami to 2.1.2 or newer.
Jun 27, 2022Login With OTP Over SMS, Email, WhatsApp and Google Authenticator: Does not escape its settingsCVE-2022-1994 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Login With OTP Over SMS, Email, WhatsApp and Google Authenticator
- Fixed in
- 1.0.8
- What to do
- Update Login With OTP Over SMS, Email, WhatsApp and Google Authenticator to 1.0.8 or newer.
Jun 20, 2022WP-EMail: Does not protect its log deletion functionality with nonce checksCVE-2022-1630 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack
- Product
- WP-EMail
- Fixed in
- 2.69.0
- What to do
- Update WP-EMail to 2.69.0 or newer.
Jun 20, 2022WP-EMail: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1614 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based anti-spamming restrictions.
- Product
- WP-EMail
- Fixed in
- 2.69.0
- What to do
- Update WP-EMail to 2.69.0 or newer.
Jun 20, 2022Print, PDF, Email by PrintFriendly: Does not sanitise and escape the Custom Button Text settingsCVE-2022-0663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Print, PDF, Email by PrintFriendly
- Fixed in
- 5.2.3
- What to do
- Update Print, PDF, Email by PrintFriendly to 5.2.3 or newer.
Jun 13, 2022New User Email Set Up: Does not have CSRF check in placeCVE-2022-1790 · WordPress plugins & themes · reported by WPScanMedium 6.5
The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- New User Email Set Up
- Affected
- up to 0.5.2
- What to do
- Affects up to 0.5.2. Update New User Email Set Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Email Users: Does not have CSRF check in placeCVE-2022-1605 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and change the notification settings of arbitrary users
- Product
- Email Users
- Affected
- up to 4.8.8
- What to do
- Affects up to 4.8.8. Update Email Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Log WP_Mail: Saves sent email in a publicly accessible directory using predictable filenamesCVE-2022-1412 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visitor to obtain potentially sensitive information like generated passwords.
- Product
- Log WP_Mail
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Log WP_Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
May 23, 2022Check & Log Email: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1547 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Check & Log Email
- Fixed in
- 1.0.6
- What to do
- Update Check & Log Email to 1.0.6 or newer.
May 2, 2022Visual Form Builder: Does not sanitise and escape the form's 'Email to' fieldCVE-2022-1046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Visual Form Builder
- Fixed in
- 3.0.7
- What to do
- Update Visual Form Builder to 3.0.7 or newer.
Apr 19, 2022The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API routeCVE-2022-1186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 11, 2022LearnPress: Does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX actionCVE-2022-0271 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- LearnPress
- Fixed in
- 4.1.6
- What to do
- Update LearnPress to 4.1.6 or newer.
Mar 28, 2022SpeakOut! Email Petitions: Does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX actionCVE-2022-0846 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- SpeakOut! Email Petitions
- Fixed in
- 2.14.15.1
- What to do
- Update SpeakOut! Email Petitions to 2.14.15.1 or newer.
Mar 14, 2022WP Email Users: Does not escape the data_raw parameter in the weu_selected_users_1 AJAX actionCVE-2021-24959 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.
- Product
- WP Email Users
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update WP Email Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2022Email Subscribers & Newsletters: Does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` actionCVE-2022-0439 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
- Product
- Email Subscribers & Newsletters
- Fixed in
- 5.3.2
- What to do
- Update Email Subscribers & Newsletters to 5.3.2 or newer.
Feb 28, 2022Customize WordPress Emails and Alerts: Does not have authorisation and CSRF check in its bnfw_search_users AJAX actionCVE-2022-0345 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
- Product
- Customize WordPress Emails and Alerts
- Fixed in
- 1.8.7
- What to do
- Update Customize WordPress Emails and Alerts to 1.8.7 or newer.
Feb 28, 2022In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unCVE-2021-24704 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
- Product
- Orange Form
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the lang and pid parameter before outputting them back in attributesCVE-2021-24874 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.31
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.31 or newer.
Feb 7, 2022Translate WordPress with GTranslate: Does not sanitise and escape the body parameter in the url_addon/gtranslate-emailCVE-2021-25103 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCE_SALT and NONCE_KEY
- Product
- Translate WordPress with GTranslate
- Fixed in
- 2.9.7
- What to do
- Update Translate WordPress with GTranslate to 2.9.7 or newer.
Feb 1, 2022Learning Courses: Does not sanitise and escape the Email PDT identity token settingsCVE-2021-24707 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Learning Courses
- Fixed in
- 5.0
- What to do
- Update Learning Courses to 5.0 or newer.
Jan 24, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the sib-statistics-date parameter before outputting it back in an attributeCVE-2021-24923 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.25
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.25 or newer.
Jan 19, 2022Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.CVE-2021-44777 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).
- Affected
- up to 5.2.6
- What to do
- Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 27, 2021Gwolle Guestbook: Does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attributeCVE-2021-24980 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page
- Product
- Gwolle Guestbook
- Fixed in
- 4.2.0
- What to do
- Update Gwolle Guestbook to 4.2.0 or newer.
Dec 6, 2021Email Log: Does not escape the d parameter before outputting it back in an attribute in the Log pageCVE-2021-24924 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue
- Product
- Email Log
- Fixed in
- 2.4.8
- What to do
- Update Email Log to 2.4.8 or newer.
Nov 29, 2021Check & Log Email: Does not escape the d parameter before outputting it back in an attributeCVE-2021-24908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Check & Log Email
- Fixed in
- 1.0.4
- What to do
- Update Check & Log Email to 1.0.4 or newer.
Nov 29, 2021Email Before Download: Does not properly validate and escape the order and orderby GET parameters before using them in SQL statementsCVE-2021-24748 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
- Product
- Email Before Download
- Fixed in
- 6.8
- What to do
- Update Email Before Download to 6.8 or newer.
Nov 23, 2021Forminator: Does not sanitize and escape the email field labelCVE-2021-24700 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Forminator
- Fixed in
- 1.15.4
- What to do
- Update Forminator to 1.15.4 or newer.
Nov 17, 2021Contact Form Email: Stored Cross-Site ScriptingCVE-2021-42361 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Contact Form Email
- Affected
- up to 1.3.24
- What to do
- Affects up to 1.3.24. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
- Product
- My Tickets
- Fixed in
- 1.8.31
- What to do
- Update My Tickets to 1.8.31 or newer.
Nov 17, 2021Email Log: Does not properly validateCVE-2021-24758 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections
- Product
- Email Log
- Fixed in
- 2.4.7
- What to do
- Update Email Log to 2.4.7 or newer.
Oct 25, 2021Check & Log Email: Does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statementCVE-2021-24774 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
- Product
- Check & Log Email
- Fixed in
- 1.0.3
- What to do
- Update Check & Log Email to 1.0.3 or newer.
Sep 22, 2021Ninja Forms: Arbitrary email sendingCVE-2021-34648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.
- Product
- Ninja Forms
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 13, 2021Email Artillery (MASS EMAIL): Does not properly check the uploaded files from the Import Emails featureCVE-2021-24490 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS
- Product
- Email Artillery (MASS EMAIL)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Email Artillery (MASS EMAIL) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2021DJ EmailPublish: Reflected Cross-Site ScriptingCVE-2021-38329 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2.
- Product
- DJ EmailPublish
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update DJ EmailPublish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021User Activation Email: Reflected Cross-Site ScriptingCVE-2021-38325 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0.
- Product
- User Activation Email
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update User Activation Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2021Email Encoder – Protect Email Addresses: Has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the dataCVE-2021-24599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.
- Product
- Email Encoder – Protect Email Addresses
- Fixed in
- 2.1.2
- What to do
- Update Email Encoder – Protect Email Addresses to 2.1.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.