Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,648 results · page 108 of 113
Oct 25, 2021Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for: Does not sanitise and escape its Form's LabelsCVE-2021-24608 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for
- Fixed in
- 5.0.07
- What to do
- Update Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for to 5.0.07 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 25, 2021Responsive WordPress Slider: Does not sanitise and escape some of the Slider optionsCVE-2021-24544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example.
- Product
- Responsive WordPress Slider
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Responsive WordPress Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021jQuery Reply to Comment: Does not have any CSRF checkCVE-2021-24543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
- Product
- jQuery Reply to Comment
- Affected
- up to 1.31
- What to do
- Affects up to 1.31. Update jQuery Reply to Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021Video Gallery: Does not escape the Title and Description of the videos in a gallery before outputting them in attributesCVE-2021-24515 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues
- Product
- Video Gallery
- Fixed in
- 1.1.5
- What to do
- Update Video Gallery to 1.1.5 or newer.
Oct 25, 2021Visual Form Builder: Does not sanitise or escape its Form NameCVE-2021-24514 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
- Product
- Visual Form Builder
- Fixed in
- 3.0.4
- What to do
- Update Visual Form Builder to 3.0.4 or newer.
Oct 25, 2021Request a Quote: Does not sanitiseCVE-2021-24489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
- Product
- Request a Quote
- Fixed in
- 2.3.9
- What to do
- Update Request a Quote to 2.3.9 or newer.
Oct 25, 2021St-Daily-Tip: Does not have any CSRF check in placeCVE-2021-24487 · WordPress plugins & themes · reported by WPScanHigh 8.8
The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue
- Product
- St-Daily-Tip
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update St-Daily-Tip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021Special Text Boxes: Does not sanitise or escape some of its settingsCVE-2021-24485 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Special Text Boxes
- Fixed in
- 5.9.110
- What to do
- Update Special Text Boxes to 5.9.110 or newer.
Oct 25, 2021Video Player for YouTube: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Video Player for YouTube
- Fixed in
- 1.4
- What to do
- Update Video Player for YouTube to 1.4 or newer.
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.5.8.2
- What to do
- Update Ninja Forms Contact Form to 3.5.8.2 or newer.
Oct 18, 2021Gutenberg PDF Viewer Block: Does not sanitise and escape its blockCVE-2021-24760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Gutenberg PDF Viewer Block
- Fixed in
- 1.0.1
- What to do
- Update Gutenberg PDF Viewer Block to 1.0.1 or newer.
Oct 18, 2021MainWP Child Reports: Does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboardCVE-2021-24754 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue
- Product
- MainWP Child Reports
- Fixed in
- 2.0.8
- What to do
- Update MainWP Child Reports to 2.0.8 or newer.
Oct 18, 2021Tutor LMS: Does not escape some of its settings before outputting them in attributesCVE-2021-24740 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Tutor LMS
- Fixed in
- 1.9.9
- What to do
- Update Tutor LMS to 1.9.9 or newer.
Oct 18, 2021Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files: Does not sanitise and escape some of its settings before outputting them in attributesCVE-2021-24736 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.
- Product
- Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files
- Fixed in
- 1.6.57
- What to do
- Update Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files to 1.6.57 or newer.
Oct 18, 2021Compact WP Audio Player: Does not implement nonce checksCVE-2021-24735 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack.
- Product
- Compact WP Audio Player
- Fixed in
- 1.9.7
- What to do
- Update Compact WP Audio Player to 1.9.7 or newer.
Oct 18, 2021Compact WP Audio Player: Does not escape some of its shortcodes attributesCVE-2021-24734 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Compact WP Audio Player
- Fixed in
- 1.9.7
- What to do
- Update Compact WP Audio Player to 1.9.7 or newer.
Oct 18, 2021PDF Flipbook, 3D Flipbook WordPress – DearFlip: Does not escape the class attribute of its shortcode before outputting it back in an attributeCVE-2021-24732 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- PDF Flipbook, 3D Flipbook WordPress – DearFlip
- Fixed in
- 1.7.10
- What to do
- Update PDF Flipbook, 3D Flipbook WordPress – DearFlip to 1.7.10 or newer.
Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
- Product
- LearnPress
- Fixed in
- 4.1.3.1
- What to do
- Update LearnPress to 4.1.3.1 or newer.
Oct 18, 2021Find My Blocks: Does not have authorisation checks in its REST APICVE-2021-24677 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.
- Product
- Find My Blocks
- Fixed in
- 3.4.0
- What to do
- Update Find My Blocks to 3.4.0 or newer.
Oct 18, 2021One User Avatar: Does not check for CSRFCVE-2021-24675 · WordPress plugins & themes · reported by WPScanMedium 6.5
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack
- Product
- One User Avatar
- Fixed in
- 2.3.7
- What to do
- Update One User Avatar to 2.3.7 or newer.
Oct 18, 2021One User Avatar: Does not escape the link and target attributes of its shortcodeCVE-2021-24672 · WordPress plugins & themes · reported by WPScanMedium 5.4
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- One User Avatar
- Fixed in
- 2.3.7
- What to do
- Update One User Avatar to 2.3.7 or newer.
Oct 18, 2021Scroll Baner: Does not have CSRF check in placeCVE-2021-24642 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS
- Product
- Scroll Baner
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Scroll Baner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Customer Service Software & Support Ticket System: Does not sanitize or escape form fields before outputting it in the ListCVE-2021-24622 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Customer Service Software & Support Ticket System
- Fixed in
- 5.10.4
- What to do
- Update Customer Service Software & Support Ticket System to 5.10.4 or newer.
Oct 18, 2021GamePress: Does not escape the op_edit POST parameter before outputting it back in multiple Game Option pagesCVE-2021-24617 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues
- Product
- GamePress
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update GamePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Wechat Reward: Does not sanitise or escape its QR settingsCVE-2021-24615 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.
- Product
- Wechat Reward
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Wechat Reward to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Sociable: Does not sanitise or escape some of its settings before outputting them in the admins dashboardCVE-2021-24612 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed
- Product
- Sociable
- Affected
- up to 4.3.4.1
- What to do
- Affects up to 4.3.4.1. Update Sociable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021PlanSo Forms: Does not escape the title of its Form before outputting it in attributesCVE-2021-24516 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
- Product
- PlanSo Forms
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update PlanSo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021StreamCast – Radio Player for: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24416 · WordPress plugins & themes · reported by WPScanMedium 5.4
The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- StreamCast – Radio Player for
- Fixed in
- 2.1.1
- What to do
- Update StreamCast – Radio Player for to 2.1.1 or newer.
Oct 18, 2021Polo Video Gallery – Best wordpress video gallery: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24415 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Polo Video Gallery – Best wordpress video gallery
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Polo Video Gallery – Best wordpress video gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Easy Twitter Feed: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24413 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Easy Twitter Feed
- Fixed in
- 1.2
- What to do
- Update Easy Twitter Feed to 1.2 or newer.
Oct 18, 2021Html5 Audio Player – Audio Player for: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24412 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Html5 Audio Player – Audio Player for
- Fixed in
- 2.1.3
- What to do
- Update Html5 Audio Player – Audio Player for to 2.1.3 or newer.
Oct 11, 2021Comments – wpDiscuz: Does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the pageCVE-2021-24737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Comments – wpDiscuz
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2021Appointment Hour Booking: Does not properly sanitize values usedCVE-2021-24712 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.17
- What to do
- Update Appointment Hour Booking to 1.3.17 or newer.
Oct 11, 2021del_reistered_domains AJAX action of the Software License Manager: Does not have any CSRF checksCVE-2021-24711 · WordPress plugins & themes · reported by WPScanHigh 8.8
The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack
- Product
- del_reistered_domains AJAX action of the Software License Manager
- Fixed in
- 4.5.1
- What to do
- Update del_reistered_domains AJAX action of the Software License Manager to 4.5.1 or newer.
Oct 11, 2021Weather Effect: Does not properly validate and escape some of its settings (like *_size_leafCVE-2021-24709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which could lead to Stored Cross-Site Scripting issues
- Product
- Weather Effect
- Fixed in
- 1.3.6
- What to do
- Update Weather Effect to 1.3.6 or newer.
Oct 11, 2021Quiz And Survey Master: Does not escape the Quiz Url Slug setting before outputting it in some pagesCVE-2021-24691 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Quiz And Survey Master
- Fixed in
- 7.3.2
- What to do
- Update Quiz And Survey Master to 7.3.2 or newer.
Oct 11, 2021Chained Quiz: Does not properly sanitize or escape inputs in the plugin's settingsCVE-2021-24690 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings.
- Product
- Chained Quiz
- Fixed in
- 1.2.7.2
- What to do
- Update Chained Quiz to 1.2.7.2 or newer.
Oct 11, 2021Weather Effect: Does not have any CSRF checks in placeCVE-2021-24683 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.
- Product
- Weather Effect
- Fixed in
- 1.3.4
- What to do
- Update Weather Effect to 1.3.4 or newer.
Oct 11, 2021Duplicate Page: Does not sanitise or escape the Duplicate Post Suffix settings before outputting itCVE-2021-24681 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Duplicate Page
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update Duplicate Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2021Simple Social Media Share Buttons: Does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used)CVE-2021-24656 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Social Media Share Buttons
- Fixed in
- 3.2.4
- What to do
- Update Simple Social Media Share Buttons to 3.2.4 or newer.
Oct 11, 2021Coming soon and Maintenance mode: Does not properly sanitize inputs submitted by authenticated usersCVE-2021-24577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.5.3
- What to do
- Update Coming soon and Maintenance mode to 3.5.3 or newer.
Oct 11, 2021Easy Accordion: Does not properly sanitize inputsCVE-2021-24576 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion.
- Product
- Easy Accordion
- Fixed in
- 2.0.22
- What to do
- Update Easy Accordion to 2.0.22 or newer.
Oct 11, 2021Frontend Uploader: Does not prevent HTML files from being uploaded via its formCVE-2021-24563 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
- Product
- Frontend Uploader
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Frontend Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Oct 11, 2021Gutenberg Block Editor Toolkit – EditorsKit: Does not sanitise and validate the Conditional Logic of the Custom Visibility settingsCVE-2021-24546 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code
- Product
- Gutenberg Block Editor Toolkit – EditorsKit
- Fixed in
- 1.31.6
- What to do
- Update Gutenberg Block Editor Toolkit – EditorsKit to 1.31.6 or newer.
Oct 11, 2021WP HTML Author Bio: Does not sanitise the HTML allowed in the Bio of usersCVE-2021-24545 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against users, which could potentially lead to privilege escalation when an admin view the related post/s.
- Product
- WP HTML Author Bio
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update WP HTML Author Bio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.2
- What to do
- Update Modern Events Calendar Lite to 5.22.2 or newer.
Oct 4, 2021Bitcoin / AltCoin Payment Gateway for WooCommerce: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
- Product
- Bitcoin / AltCoin Payment Gateway for WooCommerce
- Fixed in
- 1.6.1
- What to do
- Update Bitcoin / AltCoin Payment Gateway for WooCommerce to 1.6.1 or newer.
Oct 4, 2021CM Tooltip Glossary: Does not escape some glossary_tooltip shortcode attributesCVE-2021-24678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- CM Tooltip Glossary
- Fixed in
- 3.9.21
- What to do
- Update CM Tooltip Glossary to 3.9.21 or newer.
Oct 4, 2021Better Find and Replace: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24676 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
- Product
- Better Find and Replace
- Fixed in
- 1.2.9
- What to do
- Update Better Find and Replace to 1.2.9 or newer.
Oct 4, 2021Appointment Hour Booking: Does not escape some of the Calendar Form settingsCVE-2021-24673 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.16
- What to do
- Update Appointment Hour Booking to 1.3.16 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.