Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
476 results · page 10 of 10
Sep 13, 2021Daily Prayer Time: Does not sanitise or escape some of its settings before outputting them in the pageCVE-2021-24523 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.
- Product
- Daily Prayer Time
- Fixed in
- 2021.08.10
- What to do
- Update Daily Prayer Time to 2021.08.10 or newer.
Aug 23, 2021Timeline Calendar: Does not sanitiseCVE-2021-24553 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin
- Product
- Timeline Calendar
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Timeline Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 2, 2021User Registration & User Profile – Profile Builder: Does not sanitise or escape its 'Modify default Redirect Delay timer' settingCVE-2021-24448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- User Registration & User Profile – Profile Builder
- Fixed in
- 3.4.8
- What to do
- Update User Registration & User Profile – Profile Builder to 3.4.8 or newer.
Jun 1, 2021The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super CaCVE-2021-24312 · WordPress plugins & themes · reported by WPScanHigh 7.2
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
- Fixed in
- 1.7.3
- What to do
- Update the plugin to 1.7.3 or newer.
May 17, 2021It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress PluCVE-2021-24295 · WordPress plugins & themes · reported by WPScanHigh 7.5
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
- Product
- Spam protection, AntiSpam, FireWall by CleanTalk
- Fixed in
- 5.153.4
- What to do
- Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.153.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12,CVE-2021-24193 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Visitor Traffic Real Time Statistics
- Fixed in
- 2.12
- What to do
- Update Visitor Traffic Real Time Statistics to 2.12 or newer.
Apr 5, 2021tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24185 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
- Product
- tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution
- Fixed in
- 1.7.7
- What to do
- Update tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24181 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
- Product
- tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution
- Fixed in
- 1.7.7
- What to do
- Update tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jan 6, 2021The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.CVE-2020-36170 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.
- Product
- Ultimate Member
- Fixed in
- 2.1.13
- What to do
- Update Ultimate Member to 2.1.13 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Sep 13, 2020In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or pCVE-2020-25286 · WordPress plugins & themes · reported by MITREMedium 5.3
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.
- Fixed in
- 5.4.2
- What to do
- Update the plugin to 5.4.2 or newer.
Full record and what to do →NVD recordcore.trac.wordpress.orgwordpress.org
Jul 9, 2020In TimelineJS before version 3.7.0, some user data renders as HTML.CVE-2020-15092 · WordPress plugins & themes · reported by GitHubHigh 7.2
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most TimelineJS users configure their timeline with a Google Sheets document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if they grant public write access to the document. Some TimelineJS users configure their timeline with a JSON document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if write access to the system hosting that document is otherwise compromised. Version 3.7.0 of TimelineJS addresses this in two ways. For content which is intended to support limited HTML markup for styling and linking, that content is "sanitized" before being added to the DOM. For content intended for simple text display, all markup is stripped. Very few users
- Product
- code. Some users of TimelineJS use it as a part of a
- What to do
- Update code. Some users of TimelineJS use it as a part of a to the newest version.
Full record and what to do →NVD recordgithub.comknightlab.northwestern.edu
May 28, 2020An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress.CVE-2020-13641 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser.
- Product
- An issue was discovered in the Real-Time Find and Replace
- Fixed in
- 4.0.2
- What to do
- Update An issue was discovered in the Real-Time Find and Replace to 4.0.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Feb 11, 2020participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the aCVE-2020-8596 · WordPress plugins & themes · reported by MITREHigh 7.5
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
- Product
- Participants Database
- Affected
- up to 1.9.5.5
- What to do
- Affects up to 1.9.5.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.impenetrable.techwpvulndb.com
Feb 6, 2020The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass.CVE-2020-8771 · WordPress plugins & themes · reported by MITRECritical 9.8
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
- Product
- Time Capsule
- Fixed in
- 1.21.16
- What to do
- Update Time Capsule to 1.21.16 or newer.
Full record and what to do →NVD recordwpvulndb.comwebarxsecurity.com
Sep 26, 2019The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.CVE-2015-9443 · WordPress plugins & themes · reported by MITREMedium 6.5
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
- Affected
- 1.2 to 1.2
- What to do
- Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.CVE-2019-15832 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
- Product
- visitors-traffic-real-time-statistics
- Fixed in
- 1.13
- What to do
- Update visitors-traffic-real-time-statistics to 1.13 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 30, 2019The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.CVE-2019-15831 · WordPress plugins & themes · reported by MITREHigh 8.8
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
- Product
- visitors-traffic-real-time-statistics
- Fixed in
- 1.12
- What to do
- Update visitors-traffic-real-time-statistics to 1.12 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 27, 2019The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.CVE-2017-18590 · WordPress plugins & themes · reported by MITREMedium 6.1
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
- Product
- timesheet
- Fixed in
- 0.1.5
- What to do
- Update timesheet to 0.1.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.CVE-2016-10928 · WordPress plugins & themes · reported by MITREHigh 7.5
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
- Product
- onelogin-saml-sso
- Fixed in
- 2.2.0
- What to do
- Update onelogin-saml-sso to 2.2.0 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Aug 22, 2019The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.CVE-2017-18582 · WordPress plugins & themes · reported by MITREMedium 6.1
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
- Product
- time-sheets
- Fixed in
- 1.5.2
- What to do
- Update time-sheets to 1.5.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.CVE-2017-18581 · WordPress plugins & themes · reported by MITREMedium 6.1
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
- Product
- time-sheets
- Fixed in
- 1.5.0
- What to do
- Update time-sheets to 1.5.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Apr 15, 2019The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.CVE-2018-17586 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.
- Affected
- 0.8.8.5 to 0.8.8.5
- What to do
- Affects 0.8.8.5 to 0.8.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordansawaf.blogspot.comdocs.google.com
Sep 28, 2017Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) tCVE-2017-14507 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php or (3) pages/content_timeline_index.php.
- Product
- Content Timeline
- Affected
- 4.4.2 to 4.4.2
- What to do
- Affects 4.4.2 to 4.4.2. Update Content Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comexploit-db.com
Nov 9, 2015The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgetCVE-2015-5730 · WordPress plugins & themes · reported by MITREMedium 5
The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.
- Fixed in
- 4.2.4
- What to do
- Update the plugin to 4.2.4 or newer.
Full record and what to do →NVD recordopenwall.comdebian.org
Jan 5, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the autCVE-2014-9525 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_popup_subtitle parameter in the wp-popup.php page to wp-admin/options-general.php.
- Product
- Timed Popup (wp-timed-popup)
- What to do
- Update Timed Popup (wp-timed-popup) to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Apr 28, 2008The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers tCVE-2008-1930 · WordPress plugins & themes · reported by MITREHigh 7.5
The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers to forge cookies by registering a username that results in the same concatenated string, as demonstrated by registering usernames beginning with "admin" to obtain administrator privileges, aka a "cryptographic splicing" issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-6013.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecunia.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.