Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

511new WordPress flaws this week

397,455entries in the database

5,648 results · page 110 of 113

Sep 6, 2021Highlight: Does not sanitise its CustomCSS settingCVE-2021-24591 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Highlight
Fixed in
0.9.3
What to do
Update Highlight to 0.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization optionsCVE-2021-24590 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.
Product
Cookie Notice & Consent Banner for GDPR & CCPA Compliance
Fixed in
1.7.2
What to do
Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to 1.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021AddToAny Share Buttons: Does not sanitise its Sharing Header settingCVE-2021-24568 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
AddToAny Share Buttons
Fixed in
1.7.46
What to do
Update AddToAny Share Buttons to 1.7.46 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2021.18
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2021.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021Form Builder | Create Responsive Contact Forms: Does not sanitise or escape its Form TitleCVE-2021-24513 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
Product
Form Builder | Create Responsive Contact Forms
Fixed in
1.9.8.4
What to do
Update Form Builder | Create Responsive Contact Forms to 1.9.8.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in aCVE-2021-24435 · WordPress plugins & themes · reported by WPScanMedium 6.1
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues
Affected
up to 1.12.1
What to do
Affects up to 1.12.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021JiangQie Official Website Mini Program: Does not escape or validate the id GET parameter before using it in SQL statementsCVE-2021-24303 · WordPress plugins & themes · reported by WPScanHigh 8.8
The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues
Product
JiangQie Official Website Mini Program
Fixed in
1.1.1
What to do
Update JiangQie Official Website Mini Program to 1.1.1 or newer.
Full record and what to do →NVD record github.com wpscan.com
Sep 2, 2021The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file.CVE-2021-39322 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Product
Easy Social Icons
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Easy Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Sep 1, 2021The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file.CVE-2021-39320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Product
underConstruction
Affected
up to 1.18
What to do
Affects up to 1.18. Update underConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
Aug 30, 2021WP Video Lightbox: Does not escape the attributes of its shortcodesCVE-2021-24665 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
WP Video Lightbox
Fixed in
1.9.3
What to do
Update WP Video Lightbox to 1.9.3 or newer.
Full record and what to do →NVD record wpscan.com fortiguard.com
Aug 30, 2021Business Hours Indicator: Does not sanitise or escape its 'Now closed message" settingCVE-2021-24593 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue
Product
Business Hours Indicator
Fixed in
2.3.5
What to do
Update Business Hours Indicator to 2.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021Sitewide Notice WP: Does not sanitise some of its settings before outputting them in frontend pagesCVE-2021-24592 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Sitewide Notice WP
Fixed in
2.3
What to do
Update Sitewide Notice WP to 2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021Blue Admin: Does not sanitise or escape its "Logo Title" setting before outputting in a pageCVE-2021-24581 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.
Product
Blue Admin
Affected
up to 21.06.01
What to do
Affects up to 21.06.01. Update Blue Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021Side Menu Lite: Does not sanitise user input from the List page in the admin dashboard before using it in SQL statementCVE-2021-24580 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue
Product
Side Menu Lite
Fixed in
2.2.6
What to do
Update Side Menu Lite to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021FluentSMTP: Does not sanitize parameters before storing the settings in the databaseCVE-2021-24528 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.
Product
FluentSMTP
Fixed in
2.0.1
What to do
Update FluentSMTP to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021ShareThis Dashboard for Google Analytics: Does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attributeCVE-2021-24438 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
Product
ShareThis Dashboard for Google Analytics
Fixed in
2.5.2
What to do
Update ShareThis Dashboard for Google Analytics to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021Favicon by RealFaviconGenerator: Does not sanitise or escape one of its parameter before outputting it back in the responseCVE-2021-24437 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.
Product
Favicon by RealFaviconGenerator
Affected
up to 1.3.20
What to do
Affects up to 1.3.20. Update Favicon by RealFaviconGenerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021HM Multiple Roles: Does not have any access control to prevent low privilege users to set themselvesCVE-2021-24602 · WordPress plugins & themes · reported by WPScanHigh 8.8
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
Product
HM Multiple Roles
Fixed in
1.3
What to do
Update HM Multiple Roles to 1.3 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Aug 23, 2021Simple Banner: Does not sanitise and escape one of its settingsCVE-2021-24574 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfiltered_html capability is disallowed.
Product
Simple Banner
Fixed in
2.10.4
What to do
Update Simple Banner to 2.10.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Aug 23, 2021HD Quiz: Does not escape some of its Answers before outputting them in attributeCVE-2021-24571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to Stored Cross-Site Scripting issues
Product
HD Quiz
Fixed in
1.8.4
What to do
Update HD Quiz to 1.8.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021Contact Form 7 Captcha: Does not have any CSRF check in placeCVE-2021-24565 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.
Product
Contact Form 7 Captcha
Fixed in
0.0.9
What to do
Update Contact Form 7 Captcha to 0.0.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Aug 23, 2021WPFront Scroll Top: Does not sanitise or escape its Image ALT setting before outputting it attributesCVE-2021-24564 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
Product
WPFront Scroll Top
Fixed in
2.0.6.07225
What to do
Update WPFront Scroll Top to 2.0.6.07225 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021WP SMS: Does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" pageCVE-2021-24561 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue
Product
WP SMS
Fixed in
5.4.13
What to do
Update WP SMS to 5.4.13 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Aug 23, 2021pspin_duplicate_post_save_as_new_post function of the Project Status: Does not sanitiseCVE-2021-24558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue
Product
pspin_duplicate_post_save_as_new_post function of the Project Status
Affected
up to 1.6
What to do
Affects up to 1.6. Update pspin_duplicate_post_save_as_new_post function of the Project Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted CVE-2021-24556 · WordPress plugins & themes · reported by WPScanMedium 6.1
The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting them back in the Subscriber list (/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings), leading a Stored XSS issue.
Product
Email Subscriber
Affected
up to 1.1
What to do
Affects up to 1.1. Update Email Subscriber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021Paytm – Donation: Does not sanitiseCVE-2021-24554 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue
Product
Paytm – Donation
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Paytm – Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021Timeline Calendar: Does not sanitiseCVE-2021-24553 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin
Product
Timeline Calendar
Affected
up to 1.2
What to do
Affects up to 1.2. Update Timeline Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021Simple Events Calendar: Does not sanitiseCVE-2021-24552 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue
Product
Simple Events Calendar
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Simple Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021Edit Comments: Does not sanitiseCVE-2021-24551 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue
Product
Edit Comments
Affected
up to 0.3
What to do
Affects up to 0.3. Update Edit Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021Broken Link Manager: Does not sanitiseCVE-2021-24550 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue
Product
Broken Link Manager
Affected
up to 0.6.5
What to do
Affects up to 0.6.5. Update Broken Link Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021AceIDE: Does not sanitise or validate the user inputCVE-2021-24549 · WordPress plugins & themes · reported by WPScanMedium 4.9
The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server outside of the blog directory via a path traversal attack.
Product
AceIDE
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update AceIDE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021Maintenance: Does not sanitise or escape some of its settingsCVE-2021-24533 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them (even when the unfiltered_html capability is disallowed), which will be triggered in the frontend
Product
Maintenance
Fixed in
4.03
What to do
Update Maintenance to 4.03 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021Grid Gallery – Photo Image Grid Gallery: Does not properly sanitize the title field for image galleriesCVE-2021-24529 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability.
Product
Grid Gallery – Photo Image Grid Gallery
Fixed in
1.2.5
What to do
Update Grid Gallery – Photo Image Grid Gallery to 1.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021Slider Hero with Animation, Video Background & Intro Maker: Does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statementCVE-2021-24506 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
Product
Slider Hero with Animation, Video Background & Intro Maker
Fixed in
8.2.7
What to do
Update Slider Hero with Animation, Video Background & Intro Maker to 8.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Wonder PDF Embed: Does not escape parameters of its wonderplugin_pdf shortcodeCVE-2021-24541 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
Product
Wonder PDF Embed
Fixed in
1.7
What to do
Update Wonder PDF Embed to 1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Wonder Video Embed: Does not escape parameters of its wonderplugin_video shortcodeCVE-2021-24540 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
Product
Wonder Video Embed
Fixed in
1.8
What to do
Update Wonder Video Embed to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Current Book: Does not sanitize user inputCVE-2021-24538 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue.
Product
Current Book
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Current Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Custom Login Redirect: Does not have CSRF check in placeCVE-2021-24536 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue
Product
Custom Login Redirect
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Custom Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021PhoneTrack Meu Site Manager: Does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the pageCVE-2021-24534 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
Product
PhoneTrack Meu Site Manager
Affected
up to 0.1
What to do
Affects up to 0.1. Update PhoneTrack Meu Site Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Does not escape its Form Title before outputting it in an attributeCVE-2021-24526 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Fixed in
1.13.60
What to do
Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to 1.13.60 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021VikRentCar Car Rental Management System: Does not sanitise the 'Text Next to Icon' fieldCVE-2021-24519 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue
Product
VikRentCar Car Rental Management System
Fixed in
1.1.10
What to do
Update VikRentCar Car Rental Management System to 1.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021WPFront Notification Bar: Does not sanitise or escape its Custom CSS settingCVE-2021-24518 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
WPFront Notification Bar
Fixed in
2.0.0.07176
What to do
Update WPFront Notification Bar to 2.0.0.07176 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Aug 16, 2021YouTube Embed: Does not validateCVE-2021-24471 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XSS issues by 1. using w, h, controls, cc_lang, color, language, start, stop, or style parameter of youtube shortcode, 2. by using style, class, rel, target, width, height, or alt parameter of youtube_thumb shortcode, or 3. by embedding a video whose title or description contains XSS payload (if API key is configured).
Product
YouTube Embed
Fixed in
5.2.2
What to do
Update YouTube Embed to 5.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Verse-O-Matic: Does not have any CSRF checks in placeCVE-2021-24466 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this could also lead to Stored Cross-Site Scripting issues
Product
Verse-O-Matic
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Verse-O-Matic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021My Site Audit: Does not sanitise or escape the Audit Name fieldCVE-2021-24445 · WordPress plugins & themes · reported by WPScanMedium 5.5
The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
My Site Audit
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update My Site Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Social Tape: Does not have CSRF checks in placeCVE-2021-24411 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack
Product
Social Tape
Affected
up to 1.0
What to do
Affects up to 1.0. Update Social Tape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 12, 2021Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.CVE-2021-28121 · WordPress plugins & themes · reported by MITRECritical 9.8
Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.
Fixed in
1.10
What to do
Update the plugin to 1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2021Side Menu Lite – add sticky fixed buttons: Does not properly sanitize input values from the browserCVE-2021-24521 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
Product
Side Menu Lite – add sticky fixed buttons
Fixed in
2.2.1
What to do
Update Side Menu Lite – add sticky fixed buttons to 2.2.1 or newer.
Full record and what to do →NVD record github.com wpscan.com
Aug 9, 2021Page View Count: Does not escape the postid parameter of pvc_stats shortcodeCVE-2021-24509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
Product
Page View Count
Fixed in
2.4.9
What to do
Update Page View Count to 2.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 9, 2021Marmoset Viewer: Does not property sanitizeCVE-2021-24495 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.
Product
Marmoset Viewer
Fixed in
1.9.3
What to do
Update Marmoset Viewer to 1.9.3 or newer.
Full record and what to do →NVD record johnjhacking.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.