Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

447new WordPress flaws this week

397,270entries in the database

5,583 results · page 106 of 112

Nov 8, 2021Translate WordPress – Google Language Translator: Does not sanitise and escape some of its settings before outputting it in various pagesCVE-2021-24594 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Translate WordPress – Google Language Translator
Fixed in
6.0.12
What to do
Update Translate WordPress – Google Language Translator to 6.0.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021School Management System – WPSchoolPress: Does not properly sanitize or use prepared statements before using POST variable in SQL queriesCVE-2021-24575 · WordPress plugins & themes · reported by WPScanHigh 8.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.
Product
School Management System – WPSchoolPress
Fixed in
2.1.10
What to do
Update School Management System – WPSchoolPress to 2.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Events Made Easy: Does not sanitise and escape Custom Field NamesCVE-2021-24813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Events Made Easy
Fixed in
2.2.24
What to do
Update Events Made Easy to 2.2.24 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 1, 2021BP Better Messages: Does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chatCVE-2021-24809 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions
Product
BP Better Messages
Fixed in
1.9.9.41
What to do
Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 1, 2021BP Better Messages: Sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attributeCVE-2021-24808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
BP Better Messages
Fixed in
1.9.9.41
What to do
Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 1, 2021Far Future Expiry Header: Does not have CSRF checkCVE-2021-24799 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
Far Future Expiry Header
Fixed in
1.5
What to do
Update Far Future Expiry Header to 1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Connections Business Directory: Does not escape the Address settingsCVE-2021-24794 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed.
Product
Connections Business Directory
Fixed in
10.4.3
What to do
Update Connections Business Directory to 10.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WPeMatico RSS Feed Fetcher: Does not escape the Feed URL added to a campaign before outputting it in an attributeCVE-2021-24793 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.6.12
What to do
Update WPeMatico RSS Feed Fetcher to 2.6.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Flat Preloader: Does not escape some of its settingsCVE-2021-24789 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Flat Preloader
Fixed in
1.5.5
What to do
Update Flat Preloader to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WordPress Download Manager: Does not escape some of the Download settingsCVE-2021-24773 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed
Product
WordPress Download Manager
Fixed in
3.2.16
What to do
Update WordPress Download Manager to 3.2.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Stylish Price List: Does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users)CVE-2021-24770 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users), which could allow any authenticated users, such as subscriber, to upload arbitrary images.
Product
Stylish Price List
Fixed in
6.9.1
What to do
Update Stylish Price List to 6.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Stylish Price List: Does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users)CVE-2021-24757 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.
Product
Stylish Price List
Fixed in
6.9.0
What to do
Update Stylish Price List to 6.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WP Reactions Lite: Does not properly sanitize inputs within wp-admin pagesCVE-2021-24723 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages.
Product
WP Reactions Lite
Fixed in
1.3.6
What to do
Update WP Reactions Lite to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Restaurant Menu by MotoPress: Does not properly sanitize or escape inputsCVE-2021-24722 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Restaurant Menu by MotoPress
Fixed in
2.4.2
What to do
Update Restaurant Menu by MotoPress to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021AutomatorWP: Does not perform capability checksCVE-2021-24717 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions.
Product
AutomatorWP
Fixed in
1.7.6
What to do
Update AutomatorWP to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
Product
Modern Events Calendar Lite
Fixed in
5.22.3
What to do
Update Modern Events Calendar Lite to 5.22.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WP Sitemap Page: Does not properly sanitise and escape some of its settingsCVE-2021-24715 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WP Sitemap Page
Fixed in
1.7.0
What to do
Update WP Sitemap Page to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Flat Preloader: Does not enforce nonce checksCVE-2021-24685 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)
Product
Flat Preloader
Fixed in
1.5.4
What to do
Update Flat Preloader to 1.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Cool Tag Cloud: Does not escape the style attribute of the cool_tag_cloud shortcodeCVE-2021-24682 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
Product
Cool Tag Cloud
Fixed in
2.26
What to do
Update Cool Tag Cloud to 2.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021MP3 Audio Player for Music, Radio & Podcast by Sonaar: Does not properly sanitize or escape data in some of its Playlist settingsCVE-2021-24624 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Fixed in
2.4.2
What to do
Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Coming Soon, Under Construction & Maintenance Mode By Dazzler: Does not sanitise or escape its description settingCVE-2021-24539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
Coming Soon, Under Construction & Maintenance Mode By Dazzler
Fixed in
1.6.7
What to do
Update Coming Soon, Under Construction & Maintenance Mode By Dazzler to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WP-Pro-Quiz: Does not have CSRF check in placeCVE-2020-36504 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog
Product
WP-Pro-Quiz
Affected
up to 0.37
What to do
Affects up to 0.37. Update WP-Pro-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com wpscan.com
Nov 1, 2021Connections Business Directory: Does not validate or sanitise some connections' fieldsCVE-2020-36503 · WordPress plugins & themes · reported by WPScanHigh 8
The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue
Product
Connections Business Directory
Fixed in
9.7
What to do
Update Connections Business Directory to 9.7 or newer.
Full record and what to do →NVD record github.com wpscan.com
Nov 1, 2021LearnDash LMS: Does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() functionCVE-2018-25019 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server
Product
LearnDash LMS
Fixed in
2.5.4
What to do
Update LearnDash LMS to 2.5.4 or newer.
Full record and what to do →NVD record lists.openwall.net wpscan.com
Nov 1, 2021WP Attachment Export: Does not have proper access controlsCVE-2015-20067 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
Product
WP Attachment Export
Fixed in
0.2.4
What to do
Update WP Attachment Export to 0.2.4 or newer.
Full record and what to do →NVD record github.com seclists.org
Nov 1, 2021Content text slider on post: Does not sanitise and escape the Title and Message/Content settingsCVE-2015-20019 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues
Product
Content text slider on post
Fixed in
6.9
What to do
Update Content text slider on post to 6.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org seclists.org
Nov 1, 2021WP-Stats: Does not have CSRF checkCVE-2015-10001 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
Product
WP-Stats
Fixed in
2.52
What to do
Update WP-Stats to 2.52 or newer.
Full record and what to do →NVD record wpscan.com openwall.com
Oct 25, 2021YOP Poll: Does not escape the perpage parameter before outputting it back in an attributeCVE-2021-24885 · WordPress plugins & themes · reported by WPScanMedium 6.1
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
YOP Poll
Fixed in
6.1.2
What to do
Update YOP Poll to 6.1.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 25, 2021Great Quotes: Does not sanitise and escape the Quote and Author fields of its QuotesCVE-2021-24785 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
Great Quotes
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Great Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Check & Log Email: Does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statementCVE-2021-24774 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
Product
Check & Log Email
Fixed in
1.0.3
What to do
Update Check & Log Email to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Permalink Manager Lite: Does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager pageCVE-2021-24769 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection
Product
Permalink Manager Lite
Fixed in
2.2.13.1
What to do
Update Permalink Manager Lite to 2.2.13.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021WordPress Contact Forms by Cimatti: Does not sanitise and escape the Form Title before outputting it in some admin pagesCVE-2021-24744 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
WordPress Contact Forms by Cimatti
Fixed in
1.4.12
What to do
Update WordPress Contact Forms by Cimatti to 1.4.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Easy Media Download: Does not escape the text argument of its shortcodeCVE-2021-24699 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Media Download WordPress plugin before 1.1.7 does not escape the text argument of its shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
Product
Easy Media Download
Fixed in
1.1.7
What to do
Update Easy Media Download to 1.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Game Server Status: Does not validate or escape the server_id parameter before using it in SQL statementCVE-2021-24662 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authenticated SQL Injection in an admin page
Product
Game Server Status
Affected
up to 1.0
What to do
Affects up to 1.0. Update Game Server Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Cookie Bar: Doesn't properly sanitise the Cookie Bar Message settingCVE-2021-24653 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Cookie Bar
Fixed in
1.8.9
What to do
Update Cookie Bar to 1.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for: Does not sanitise and escape its Form's LabelsCVE-2021-24608 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for
Fixed in
5.0.07
What to do
Update Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for to 5.0.07 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 25, 2021Responsive WordPress Slider: Does not sanitise and escape some of the Slider optionsCVE-2021-24544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example.
Product
Responsive WordPress Slider
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Responsive WordPress Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021jQuery Reply to Comment: Does not have any CSRF checkCVE-2021-24543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
Product
jQuery Reply to Comment
Affected
up to 1.31
What to do
Affects up to 1.31. Update jQuery Reply to Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Video Gallery: Does not escape the Title and Description of the videos in a gallery before outputting them in attributesCVE-2021-24515 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues
Product
Video Gallery
Fixed in
1.1.5
What to do
Update Video Gallery to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Visual Form Builder: Does not sanitise or escape its Form NameCVE-2021-24514 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
Product
Visual Form Builder
Fixed in
3.0.4
What to do
Update Visual Form Builder to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Request a Quote: Does not sanitiseCVE-2021-24489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
Product
Request a Quote
Fixed in
2.3.9
What to do
Update Request a Quote to 2.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021St-Daily-Tip: Does not have any CSRF check in placeCVE-2021-24487 · WordPress plugins & themes · reported by WPScanHigh 8.8
The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue
Product
St-Daily-Tip
Affected
up to 4.7
What to do
Affects up to 4.7. Update St-Daily-Tip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Special Text Boxes: Does not sanitise or escape some of its settingsCVE-2021-24485 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
Special Text Boxes
Fixed in
5.9.110
What to do
Update Special Text Boxes to 5.9.110 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Video Player for YouTube: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Product
Video Player for YouTube
Fixed in
1.4
What to do
Update Video Player for YouTube to 1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Ninja Forms Contact Form
Fixed in
3.5.8.2
What to do
Update Ninja Forms Contact Form to 3.5.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Gutenberg PDF Viewer Block: Does not sanitise and escape its blockCVE-2021-24760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
Product
Gutenberg PDF Viewer Block
Fixed in
1.0.1
What to do
Update Gutenberg PDF Viewer Block to 1.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021MainWP Child Reports: Does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboardCVE-2021-24754 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue
Product
MainWP Child Reports
Fixed in
2.0.8
What to do
Update MainWP Child Reports to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Tutor LMS: Does not escape some of its settings before outputting them in attributesCVE-2021-24740 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Tutor LMS
Fixed in
1.9.9
What to do
Update Tutor LMS to 1.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files: Does not sanitise and escape some of its settings before outputting them in attributesCVE-2021-24736 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.
Product
Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files
Fixed in
1.6.57
What to do
Update Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files to 1.6.57 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Compact WP Audio Player: Does not implement nonce checksCVE-2021-24735 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack.
Product
Compact WP Audio Player
Fixed in
1.9.7
What to do
Update Compact WP Audio Player to 1.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.