Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

490new WordPress flaws this week

397,270entries in the database

5,583 results · page 102 of 112

Feb 1, 2022SVG Support: Does not escape the "CSS Class to target" setting before outputting it in an attributeCVE-2021-24686 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
SVG Support
Fixed in
2.3.20
What to do
Update SVG Support to 2.3.20 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 1, 2022RegistrationMagic: Does not sanitise and escape the rm_search_value parameter before outputting back in an attributeCVE-2021-24648 · WordPress plugins & themes · reported by WPScanMedium 6.1
The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting
Product
RegistrationMagic
Fixed in
5.0.1.9
What to do
Update RegistrationMagic to 5.0.1.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Registrations for the Events Calendar: Does not escape the qtype parameter before outputting it back in an attribute in the settings pageCVE-2021-25083 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting
Product
Registrations for the Events Calendar
Fixed in
2.7.10
What to do
Update Registrations for the Events Calendar to 2.7.10 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Contact Form Entries: Does not validateCVE-2021-25080 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry
Product
Contact Form Entries
Fixed in
1.1.7
What to do
Update Contact Form Entries to 1.1.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Contact Form Entries: Does not sanitise and escape various parametersCVE-2021-25079 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
Product
Contact Form Entries
Fixed in
1.2.4
What to do
Update Contact Form Entries to 1.2.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Affiliates Manager: Does not validateCVE-2021-25078 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
Product
Affiliates Manager
Fixed in
2.9.0
What to do
Update Affiliates Manager to 2.9.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022WP User Frontend: Does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboardCVE-2021-25076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
Product
WP User Frontend
Fixed in
3.5.26
What to do
Update WP User Frontend to 3.5.26 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jan 24, 2022WP125: Does not have CSRF checks in various actionCVE-2021-25073 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack
Product
WP125
Fixed in
1.5.5
What to do
Update WP125 to 1.5.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Orders Tracking for WooCommerce: Does not sanitise and escape the file_url before outputting it back in an admin pageCVE-2021-25062 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Orders Tracking for WooCommerce
Fixed in
1.1.10
What to do
Update Orders Tracking for WooCommerce to 1.1.10 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Mobile Events Manager: Does not sanitise and escape various of its settingsCVE-2021-25049 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Mobile Events Manager
Fixed in
1.4.4
What to do
Update Mobile Events Manager to 1.4.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Asgaros Forum: Does not validate or escape the forum_id parameter before using it in a SQL statementCVE-2021-25045 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue
Product
Asgaros Forum
Fixed in
1.15.15
What to do
Update Asgaros Forum to 1.15.15 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Backup and Staging by WP Time Capsule: Does not sanitise and escape the error parameter before outputting it back in an admin pageCVE-2021-25035 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Backup and Staging by WP Time Capsule
Fixed in
1.22.7
What to do
Update Backup and Staging by WP Time Capsule to 1.22.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier): Does not escape the effects parameter before outputting it back in an attribute in an admin pageCVE-2021-25031 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)
Fixed in
9.7.1
What to do
Update Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) to 9.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Event Tickets: Does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given valueCVE-2021-25028 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
Product
Event Tickets
Fixed in
5.2.2
What to do
Update Event Tickets to 5.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Tutor LMS: Does not escape the search parameter before outputting it back in an attribute in an admin pageCVE-2021-25017 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Tutor LMS
Fixed in
1.9.12
What to do
Update Tutor LMS to 1.9.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022myCred: Does not sanitise and escape the search query before outputting it back in the history dashboard pageCVE-2021-25015 · WordPress plugins & themes · reported by WPScanMedium 6.1
The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue
Product
myCred
Fixed in
2.4
What to do
Update myCred to 2.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Qubely: Does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX actionCVE-2021-25013 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts
Product
Qubely
Fixed in
1.7.8
What to do
Update Qubely to 1.7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Code Snippets: Does not escape the snippets-safe-mode parameter before outputting it back in attributesCVE-2021-25008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue
Product
Code Snippets
Fixed in
2.14.3
What to do
Update Code Snippets to 2.14.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Accept Donations with PayPal: Does not have CSRF check in place and does not ensure that the post to be deleted belongs to the pluginCVE-2021-24989 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
Product
Accept Donations with PayPal
Fixed in
1.3.4
What to do
Update Accept Donations with PayPal to 1.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Easy Forms for Mailchimp: Does not sanitise and escape the field_name and field_type parameters before outputting them back in attributesCVE-2021-24985 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Easy Forms for Mailchimp
Fixed in
6.8.6
What to do
Update Easy Forms for Mailchimp to 6.8.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Smart SEO Tool: Does not sanitise and escape the search parameter before outputting it back in an attributeCVE-2021-24976 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting
Product
Smart SEO Tool
Fixed in
3.0.6
What to do
Update Smart SEO Tool to 3.0.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Product Feed PRO for WooCommerce: Does not have authorisation and CSRF check in some of its AJAX actionsCVE-2021-24974 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.
Product
Product Feed PRO for WooCommerce
Fixed in
11.0.7
What to do
Update Product Feed PRO for WooCommerce to 11.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Ultimate FAQ: Does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actionsCVE-2021-24968 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
Product
Ultimate FAQ
Fixed in
2.1.2
What to do
Update Ultimate FAQ to 2.1.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Five Star Restaurant Reservations: Does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX actionCVE-2021-24965 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it. Due to the lack of sanitisation and escaping, users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins
Product
Five Star Restaurant Reservations
Fixed in
2.4.8
What to do
Update Five Star Restaurant Reservations to 2.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022WP Extra File Types: Does not have CSRF checkCVE-2021-24936 · WordPress plugins & themes · reported by WPScanHigh 8
The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
Product
WP Extra File Types
Fixed in
0.5.1
What to do
Update WP Extra File Types to 0.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the sib-statistics-date parameter before outputting it back in an attributeCVE-2021-24923 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Fixed in
3.1.25
What to do
Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Protect WP Admin: Does not check for authorisation in the lib/pwa-deactivateCVE-2021-24906 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request
Product
Protect WP Admin
Fixed in
3.6.2
What to do
Update Protect WP Admin to 3.6.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Advanced Custom Fields: Extended: Does not validate the order and orderby parameters before using them in a SQL statementCVE-2021-24865 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
Product
Advanced Custom Fields: Extended
Fixed in
0.8.8.7
What to do
Update Advanced Custom Fields: Extended to 0.8.8.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Cookie Notification Plugin for: Does not sanitise or escape the id GET parameter before using it in a SQL statementCVE-2021-24858 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL statement, when retrieving the setting to edit in the admin dashboard, leading to an authenticated SQL Injection
Product
Cookie Notification Plugin for
Fixed in
1.0.9
What to do
Update Cookie Notification Plugin for to 1.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Simple Download Monitor: Does not enforce nonce checksCVE-2021-24696 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads
Product
Simple Download Monitor
Fixed in
3.9.9
What to do
Update Simple Download Monitor to 3.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022UpdraftPlus WordPress Backup: Does not sanitise its updraft_service settingsCVE-2021-24423 · WordPress plugins & themes · reported by WPScanMedium 4.8
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue
Product
UpdraftPlus WordPress Backup
Fixed in
1.6.59
What to do
Update UpdraftPlus WordPress Backup to 1.6.59 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jan 17, 2022EventCalendar: Does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actionsCVE-2021-25025 · WordPress plugins & themes · reported by WPScanMedium 4.3
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
Product
EventCalendar
Fixed in
1.1.51
What to do
Update EventCalendar to 1.1.51 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022EventCalendar: Does not escape some user input before outputting it back in attributesCVE-2021-25024 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
Product
EventCalendar
Fixed in
1.1.51
What to do
Update EventCalendar to 1.1.51 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022SEUR Oficial: Does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-25005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
SEUR Oficial
Fixed in
1.7.0
What to do
Update SEUR Oficial to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022ACF Photo Gallery Field: Does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_editCVE-2021-24909 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
ACF Photo Gallery Field
Fixed in
1.7.5
What to do
Update ACF Photo Gallery Field to 1.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 10, 2022WPcalc: Does not sanitize user input into the 'did' parameter and uses it in a SQL statementCVE-2021-25054 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.
Product
WPcalc
Affected
up to 2.1
What to do
Affects up to 2.1. Update WPcalc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 10, 2022WOOCS: Does not sanitise and escape the custom_prices parameter before outputting it back in the responseCVE-2021-25043 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
WOOCS
Fixed in
1.3.7.3
What to do
Update WOOCS to 1.3.7.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 10, 2022PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro: Does not have authorisation and CSRF checksCVE-2021-25032 · WordPress plugins & themes · reported by WPScanCritical 9.8
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.
Product
PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro
Fixed in
2.3.1
What to do
Update PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro to 2.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 10, 2022WP Search Filters" widget of The Plus Addons for Elementor - Pro: Does not sanitise and escape the option parameter before using it in a SQL statementCVE-2021-24949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection
Product
WP Search Filters" widget of The Plus Addons for Elementor - Pro
Fixed in
5.0.7
What to do
Update WP Search Filters" widget of The Plus Addons for Elementor - Pro to 5.0.7 or newer.
Full record and what to do →NVD record roadmap.theplusaddons.com wpscan.com
Jan 10, 2022Plus Addons for Elementor - Pro: Does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX actionCVE-2021-24948 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts
Product
Plus Addons for Elementor - Pro
Fixed in
5.0.7
What to do
Update Plus Addons for Elementor - Pro to 5.0.7 or newer.
Full record and what to do →NVD record roadmap.theplusaddons.com wpscan.com
Jan 10, 2022RegistrationMagic: Does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statementCVE-2021-24862 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
Product
RegistrationMagic
Fixed in
5.0.1.6
What to do
Update RegistrationMagic to 5.0.1.6 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jan 3, 2022Booking Calendar: Does not sanitise and escape the booking_type parameter before outputting it back in an admin pageCVE-2021-25040 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Booking Calendar
Fixed in
8.9.2
What to do
Update Booking Calendar to 8.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Events Made Easy: Does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX actionCVE-2021-25030 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks
Product
Events Made Easy
Fixed in
2.2.36
What to do
Update Events Made Easy to 2.2.36 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022PowerPack Addons for Elementor: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-25027 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
PowerPack Addons for Elementor
Fixed in
2.6.2
What to do
Update PowerPack Addons for Elementor to 2.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022Speed Booster Pack ⚡ PageSpeed Optimization Suite: Does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related tableCVE-2021-25023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection
Product
Speed Booster Pack ⚡ PageSpeed Optimization Suite
Fixed in
4.3.3.1
What to do
Update Speed Booster Pack ⚡ PageSpeed Optimization Suite to 4.3.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pagesCVE-2021-25022 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
Product
UpdraftPlus WordPress Backup
Fixed in
1.16.66
What to do
Update UpdraftPlus WordPress Backup to 1.16.66 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2022OMGF | Host Google Fonts Locally: Does not validate the cache directory settingCVE-2021-25021 · WordPress plugins & themes · reported by WPScanMedium 4.9
The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
Product
OMGF | Host Google Fonts Locally
Fixed in
4.5.12
What to do
Update OMGF | Host Google Fonts Locally to 4.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022CAOS | Host Google Analytics Locally: Does not validate the cache directory settingCVE-2021-25020 · WordPress plugins & themes · reported by WPScanMedium 4.9
The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
Product
CAOS | Host Google Analytics Locally
Fixed in
4.1.9
What to do
Update CAOS | Host Google Analytics Locally to 4.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboardCVE-2021-25001 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue
Product
Booster for WooCommerce
Fixed in
5.4.9
What to do
Update Booster for WooCommerce to 5.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboardCVE-2021-25000 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue
Product
Booster for WooCommerce
Fixed in
5.4.9
What to do
Update Booster for WooCommerce to 5.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.