Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,648 results · page 109 of 113
Oct 4, 2021User Registration: Does not properly sanitise the user_registration_profile_pic_url valueCVE-2021-24654 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed
- Product
- User Registration
- Fixed in
- 2.0.2
- What to do
- Update User Registration to 2.0.2 or newer.
Oct 4, 2021Meow Gallery: Does not sanitiseCVE-2021-24465 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available for users as low as Contributor) before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned values to be manipulated in a way that could lead to data disclosure and arbitrary objects to be deserialized.
- Product
- Meow Gallery
- Fixed in
- 4.1.9
- What to do
- Update Meow Gallery to 4.1.9 or newer.
Sep 27, 2021MX Time Zone Clocks: Does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcodeCVE-2021-24671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- MX Time Zone Clocks
- Fixed in
- 3.4.1
- What to do
- Update MX Time Zone Clocks to 3.4.1 or newer.
Sep 27, 2021CoolClock: Does not escape some shortcode attributesCVE-2021-24670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks
- Product
- CoolClock
- Fixed in
- 4.3.5
- What to do
- Update CoolClock to 4.3.5 or newer.
Sep 27, 2021WP Map Block: Does not escape some attributes of the WP Map BlockCVE-2021-24643 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WP Map Block
- Fixed in
- 1.2.3
- What to do
- Update WP Map Block to 1.2.3 or newer.
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not properly sanitise or escape some of the properties of the Recipe Card Block (suchCVE-2021-24634 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Recipe Card Blocks by WPZOOM
- Fixed in
- 2.8.3
- What to do
- Update Recipe Card Blocks by WPZOOM to 2.8.3 or newer.
Sep 27, 2021Countdown Block: Does not have authorisation in the eb_write_block_css AJAX actionCVE-2021-24633 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.
- Product
- Countdown Block
- Fixed in
- 1.1.2
- What to do
- Update Countdown Block to 1.1.2 or newer.
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not escape the message parameter before outputting it back in the admin dashboardCVE-2021-24632 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Recipe Card Blocks by WPZOOM
- Fixed in
- 2.8.1
- What to do
- Update Recipe Card Blocks by WPZOOM to 2.8.1 or newer.
Sep 27, 2021TranslatePress: Does not implement a proper sanitisation on the translated stringsCVE-2021-24610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.
- Product
- TranslatePress
- Fixed in
- 2.0.9
- What to do
- Update TranslatePress to 2.0.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 27, 2021Cookie Notice & Compliance for GDPR / CCPA: Does not escape the value of its Button Text settingCVE-2021-24569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfiltered_html capability is disallowed.
- Product
- Cookie Notice & Compliance for GDPR / CCPA
- Fixed in
- 2.1.2
- What to do
- Update Cookie Notice & Compliance for GDPR / CCPA to 2.1.2 or newer.
Sep 20, 2021Support Board: Does not escape multiple POST parameters (suchCVE-2021-24741 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
- Product
- Support Board
- Fixed in
- 3.3.4
- What to do
- Update Support Board to 3.3.4 or newer.
Full record and what to do →NVD recordboard.supportmedium.com
Sep 20, 2021Simple Schools Staff Directory: Does not validate uploaded logo pictures to ensure that are indeed imagesCVE-2021-24663 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE
- Product
- Simple Schools Staff Directory
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple Schools Staff Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021Limit Login Attempts: Does not escape the IP addresses (which can be controlled by attacker via headers suchCVE-2021-24657 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
- Product
- Limit Login Attempts
- Fixed in
- 4.0.50
- What to do
- Update Limit Login Attempts to 4.0.50 or newer.
Sep 20, 2021The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as lCVE-2021-24640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WordPress Slider Block Gutenslider
- Fixed in
- 5.2.0
- What to do
- Update WordPress Slider Block Gutenslider to 5.2.0 or newer.
Sep 20, 2021OMGF: Does not enforce path validationCVE-2021-24639 · WordPress plugins & themes · reported by WPScanHigh 8.1
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
- Product
- OMGF
- Fixed in
- 4.5.4
- What to do
- Update OMGF to 4.5.4 or newer.
Sep 20, 2021OMGF: Does not escape or validate the handle parameter of the REST APICVE-2021-24638 · WordPress plugins & themes · reported by WPScanCritical 9.1
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
- Product
- OMGF
- Fixed in
- 4.5.4
- What to do
- Update OMGF to 4.5.4 or newer.
Sep 20, 2021Google Fonts Typography: Does not escape and sanitise some of its block settingsCVE-2021-24637 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
- Product
- Google Fonts Typography
- Fixed in
- 3.0.3
- What to do
- Update Google Fonts Typography to 3.0.3 or newer.
Sep 20, 2021Print My Blog: Does not enforce nonce (CSRF) checksCVE-2021-24636 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link
- Product
- Print My Blog
- Fixed in
- 3.4.2
- What to do
- Update Print My Blog to 3.4.2 or newer.
Sep 20, 2021Visual Link Preview: Does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated usersCVE-2021-24635 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL
- Product
- Visual Link Preview
- Fixed in
- 2.2.3
- What to do
- Update Visual Link Preview to 2.2.3 or newer.
Sep 20, 2021Donate With QRCode: Does not sanitise or escape its QRCode Image settingCVE-2021-24618 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.
- Product
- Donate With QRCode
- Fixed in
- 1.4.5
- What to do
- Update Donate With QRCode to 1.4.5 or newer.
Sep 20, 2021Post Views Counter: Does not sanitise or escape its Post Views Label settingsCVE-2021-24613 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
- Product
- Post Views Counter
- Fixed in
- 1.3.5
- What to do
- Update Post Views Counter to 1.3.5 or newer.
Sep 20, 2021WP Mapa Politico Espana: Does not sanitise or escape some of its settings before outputting them in attributesCVE-2021-24609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP Mapa Politico Espana
- Fixed in
- 3.7.0
- What to do
- Update WP Mapa Politico Espana to 3.7.0 or newer.
Sep 20, 2021Availability Calendar: Does not escape the category attribute from its shortcode before using it in a SQL statementCVE-2021-24606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
- Product
- Availability Calendar
- Fixed in
- 1.2.1
- What to do
- Update Availability Calendar to 1.2.1 or newer.
Sep 20, 2021Availability Calendar: Does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embedCVE-2021-24604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Availability Calendar
- Fixed in
- 1.2.2
- What to do
- Update Availability Calendar to 1.2.2 or newer.
Sep 20, 2021WP Dialog: Does not sanitise and escape some of its settings before outputting them in pagesCVE-2021-24600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Dialog
- Affected
- up to 1.2.5.5
- What to do
- Affects up to 1.2.5.5. Update WP Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021You Shang: Does not escape its qrcode links settingsCVE-2021-24597 · WordPress plugins & themes · reported by WPScanMedium 5.4
The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used
- Product
- You Shang
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update You Shang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021youForms for: Does not sanitise escape the Button Text field of its TemplatesCVE-2021-24596 · WordPress plugins & themes · reported by WPScanMedium 4.8
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- youForms for
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update youForms for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021Splash Header: Doesn't sanitise and escape some of its settings while outputting them in the admin dashboardCVE-2021-24587 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.
- Product
- Splash Header
- Fixed in
- 1.20.8
- What to do
- Update Splash Header to 1.20.8 or newer.
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24584 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.2
- What to do
- Update Timetable and Event Schedule to 2.4.2 or newer.
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24583 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.2
- What to do
- Update Timetable and Event Schedule to 2.4.2 or newer.
Sep 20, 2021Alojapro Widget: Doesn't properly sanitise its Custom CSS settingsCVE-2021-24530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Alojapro Widget
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update Alojapro Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Comment Link Remove and Other Comment Tools: Does not have CSRF check in its 'Delete comments easily'CVE-2021-24725 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments
- Product
- Comment Link Remove and Other Comment Tools
- Fixed in
- 2.1.6
- What to do
- Update Comment Link Remove and Other Comment Tools to 2.1.6 or newer.
Full record and what to do →NVD recordwpscan.comtrustwave.com
Sep 13, 2021Timetable and Event Schedule by MotoPress: Does not sanitise some of its parametersCVE-2021-24724 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
- Product
- Timetable and Event Schedule by MotoPress
- Fixed in
- 2.3.19
- What to do
- Update Timetable and Event Schedule by MotoPress to 2.3.19 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 13, 2021WordPress Advanced Ticket System, Elite Support Helpdesk: Does not sanitize or escape form values before saving to the database orCVE-2021-24623 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordPress Advanced Ticket System, Elite Support Helpdesk
- Fixed in
- 1.0.64
- What to do
- Update WordPress Advanced Ticket System, Elite Support Helpdesk to 1.0.64 or newer.
Sep 13, 2021WP Courses LMS: Does not sanitise its Video Embed CodeCVE-2021-24621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfiltered_html capability is disallowed, which could lead to Stored Cross-Site Scripting issues
- Product
- WP Courses LMS
- Fixed in
- 2.0.44
- What to do
- Update WP Courses LMS to 2.0.44 or newer.
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
- Product
- WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Per page add to head: Does not properly sanitise one of its settingCVE-2021-24619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
- Product
- Per page add to head
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Per page add to head to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Book appointment online: Does not sanitise or escape Service Prices before outputting it in the ListCVE-2021-24614 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Book appointment online
- Fixed in
- 1.39
- What to do
- Update Book appointment online to 1.39 or newer.
Sep 13, 2021create_post_page AJAX action of the Custom Post View Generator: (available to authenticated user) does not sanitise or escape user input before outputting it back in the responseCVE-2021-24605 · WordPress plugins & themes · reported by WPScanMedium 5.4
The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue
- Product
- create_post_page AJAX action of the Custom Post View Generator
- Affected
- up to 0.4.6
- What to do
- Affects up to 0.4.6. Update create_post_page AJAX action of the Custom Post View Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Software License Manager: Does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboardCVE-2021-24560 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Software License Manager
- Fixed in
- 4.4.8
- What to do
- Update Software License Manager to 4.4.8 or newer.
Sep 13, 2021Daily Prayer Time: Does not sanitise or escape some of its settings before outputting them in the pageCVE-2021-24523 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.
- Product
- Daily Prayer Time
- Fixed in
- 2021.08.10
- What to do
- Update Daily Prayer Time to 2021.08.10 or newer.
Sep 13, 2021MF Gig Calendar: Does not sanitise and escape the id GET parameter before outputting back in the admin dashboardCVE-2021-24510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
- Product
- MF Gig Calendar
- Fixed in
- 1.2
- What to do
- Update MF Gig Calendar to 1.2 or newer.
Sep 13, 2021Smash Balloon Social Post Feed: Does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of iCVE-2021-24508 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 2.19.2
- What to do
- Update Smash Balloon Social Post Feed to 2.19.2 or newer.
Sep 13, 2021The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any securityCVE-2021-24493 · WordPress plugins & themes · reported by WPScanCritical 9.8
The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE
- Product
- Shopp
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Shopp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Fileviewer: Does not have CSRF checks in placeCVE-2021-24491 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack
- Product
- Fileviewer
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Fileviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Email Artillery (MASS EMAIL): Does not properly check the uploaded files from the Import Emails featureCVE-2021-24490 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS
- Product
- Email Artillery (MASS EMAIL)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Email Artillery (MASS EMAIL) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Language Bar Flags: Does not have any CSRF in placeCVE-2021-24431 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users
- Product
- Language Bar Flags
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Language Bar Flags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2021Keyword Meta: Does not sanitise of escape its settings before outputting them back in the page after they are savedCVE-2021-24611 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.
- Product
- Keyword Meta
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Keyword Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2021Site Reviews: Does not sanitise some of its Review DetailsCVE-2021-24603 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed
- Product
- Site Reviews
- Fixed in
- 5.13.1
- What to do
- Update Site Reviews to 5.13.1 or newer.
Sep 6, 2021WPFront Notification Bar: Does not properly sanitise and escape its settingsCVE-2021-24601 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WPFront Notification Bar
- Fixed in
- 2.1.0.08087
- What to do
- Update WPFront Notification Bar to 2.1.0.08087 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.