Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,648 results · page 111 of 113
Aug 9, 2021Leaflet Map: Does not verify the CSRF nonceCVE-2021-24467 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or using malicious attributions which will be executed in all page with an embed map from the plugin
- Product
- Leaflet Map
- Fixed in
- 3.0.0
- What to do
- Update Leaflet Map to 3.0.0 or newer.
Aug 9, 2021Newsmag: Does not sanitise the td_block_id parameter in its td_ajax_block AJAX actionCVE-2021-24304 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
- Product
- Newsmag
- Fixed in
- 5.0
- What to do
- Update Newsmag to 5.0 or newer.
Aug 2, 2021WP LMS – Best WordPress LMS: Does not properly sanitise or validate its User Field TitlesCVE-2021-24504 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)
- Product
- WP LMS – Best WordPress LMS
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP LMS – Best WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Popular Brand Icons – Simple Icons: Does not sanitise or validate some of its shortcode parametersCVE-2021-24503 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
- Product
- Popular Brand Icons – Simple Icons
- Fixed in
- 2.7.8
- What to do
- Update Popular Brand Icons – Simple Icons to 2.7.8 or newer.
Aug 2, 2021Calendar Event Multi View: Does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/editCVE-2021-24498 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.
- Product
- Calendar Event Multi View
- Fixed in
- 1.4.01
- What to do
- Update Calendar Event Multi View to 1.4.01 or newer.
Aug 2, 2021Community Events: Does not sanitiseCVE-2021-24496 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- Community Events
- Fixed in
- 1.4.8
- What to do
- Update Community Events to 1.4.8 or newer.
Aug 2, 2021The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does nCVE-2021-24492 · WordPress plugins & themes · reported by WPScanHigh 8.8
The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
- Product
- Handsome Testimonials & Reviews
- Fixed in
- 2.1.1
- What to do
- Update Handsome Testimonials & Reviews to 2.1.1 or newer.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 2, 2021Any Hostname: Does not sanitise or escape its "Allowed hosts" settingCVE-2021-24481 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it
- Product
- Any Hostname
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Any Hostname to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Event Geek: Does not sanitise or escape its "Use your own " setting before outputting it in the pageCVE-2021-24480 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its "Use your own " setting before outputting it in the page, leading to an authenticated (admin+) stored Cross-Site Scripting issue
- Product
- Event Geek
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Event Geek to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021DrawBlog: Does not sanitise or validate some of its settings before outputting them back in the pageCVE-2021-24479 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them back in the page, leading to an authenticated stored Cross-Site Scripting issue
- Product
- DrawBlog
- Affected
- up to 0.90
- What to do
- Affects up to 0.90. Update DrawBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Bookshelf: Does not sanitise or escape its "Paypal email address" setting before outputting it in the pageCVE-2021-24478 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Bookshelf
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Bookshelf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Migrate Users: Does not sanitise or escape its Delimiter option before outputting in a pageCVE-2021-24477 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack.
- Product
- Migrate Users
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Migrate Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Steam Group Viewer: Does not sanitise or escape its "Steam Group Address" settings before outputting it in the pageCVE-2021-24476 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Steam Group Viewer WordPress plugin through 2.1 does not sanitise or escape its "Steam Group Address" settings before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Steam Group Viewer
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Steam Group Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Awesome Weather Widget: Does not sanitize the id parameter of its awesome_weather_refresh AJAX actionCVE-2021-24474 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability.
- Product
- Awesome Weather Widget
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Awesome Weather Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Leaflet Map: Does not escape some shortcode attributes before they are used in JavaScript code or HTMLCVE-2021-24468 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues
- Product
- Leaflet Map
- Fixed in
- 3.0.0
- What to do
- Update Leaflet Map to 3.0.0 or newer.
Aug 2, 2021User Registration & User Profile – Profile Builder: Does not sanitise or escape its 'Modify default Redirect Delay timer' settingCVE-2021-24448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- User Registration & User Profile – Profile Builder
- Fixed in
- 3.4.8
- What to do
- Update User Registration & User Profile – Profile Builder to 3.4.8 or newer.
Aug 2, 2021TaxoPress – Create and Manage Taxonomies, Tags, Categories: Does not sanitise its Taxonomy description fieldCVE-2021-24444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.
- Product
- TaxoPress – Create and Manage Taxonomies, Tags, Categories
- Fixed in
- 3.0.7.2
- What to do
- Update TaxoPress – Create and Manage Taxonomies, Tags, Categories to 3.0.7.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
- Product
- About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
- Fixed in
- 1.0.7
- What to do
- Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Aug 2, 2021RSS for Yandex Turbo: Does not sanitise or escape some of its settings before saving and outputing them in the admin dashboardCVE-2021-24428 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed.
- Product
- RSS for Yandex Turbo
- Affected
- up to 1.30
- What to do
- Affects up to 1.30. Update RSS for Yandex Turbo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu: Does not sanitise or escape its Bar Text settingsCVE-2021-24425 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue, which will be triggered in the plugin's setting, as well as all front-page of the blog (when the Welcome bar is active)
- Product
- Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu
- Fixed in
- 2.5.2
- What to do
- Update Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu to 2.5.2 or newer.
Jul 30, 2021In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $CVE-2021-34630 · WordPress plugins & themes · reported by WordfenceMedium 5
In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Jul 19, 2021Related Posts for: Does not sanitise its heading_text and CSS settingsCVE-2021-24482 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payloads in them, leading to Stored Cross-Site Scripting issues.
- Product
- Related Posts for
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Related Posts for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2021Sign-up Sheets: Does not not sanitise or validate the Sheet titleCVE-2021-24441 · WordPress plugins & themes · reported by WPScanHigh 8
The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue
- Product
- Sign-up Sheets
- Fixed in
- 1.0.14
- What to do
- Update Sign-up Sheets to 1.0.14 or newer.
Jul 12, 2021Glass: Does not sanitise or escape its "Glass Pages" setting before outputting in a pageCVE-2021-24434 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.
- Product
- Glass
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Glass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2021Salon booking system: Does not properly sanitise and escape the First Name fieldCVE-2021-24429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.
- Product
- Salon booking system
- Fixed in
- 6.3.1
- What to do
- Update Salon booking system to 6.3.1 or newer.
Jul 12, 2021Backup by 10Web – Backup and Restore: Does not sanitise or escape the tab parameter before outputting it back in the pageCVE-2021-24426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
- Product
- Backup by 10Web – Backup and Restore
- Affected
- up to 1.0.20
- What to do
- Affects up to 1.0.20. Update Backup by 10Web – Backup and Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2021Smooth Scroll Page Up/Down Buttons: Does not properly sanitise and validate its psb_positioning settingsCVE-2021-24418 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_positioning settings, allowing high privilege users such as admin to set an XSS payload in it, which will be executed in all pages of the blog
- Product
- Smooth Scroll Page Up/Down Buttons
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Smooth Scroll Page Up/Down Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2021Prismatic: Does not escape the 'tab' GET parameter before outputting it back in an attributeCVE-2021-24409 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- Prismatic
- Fixed in
- 2.8
- What to do
- Update Prismatic to 2.8 or newer.
Jul 12, 2021Prismatic: Does not sanitise or validate some of its shortcode parametersCVE-2021-24408 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
- Product
- Prismatic
- Fixed in
- 2.8
- What to do
- Update Prismatic to 2.8 or newer.
Jun 21, 2021Autoptimize: Does not check for malicious files suchCVE-2021-24378 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
- Product
- Autoptimize
- Fixed in
- 2.7.8
- What to do
- Update Autoptimize to 2.7.8 or newer.
Jun 14, 2021The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or esCVE-2021-24345 · WordPress plugins & themes · reported by WPScanMedium 6.6
The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
- Product
- Sendit WP Newsletter
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Sendit WP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Jun 7, 2021Easy Preloader: Does not sanitise its setting fieldsCVE-2021-24344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues
- Product
- Easy Preloader
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Easy Preloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2021iFlyChat: Does not sanitise its APP ID setting before outputting it back in the pageCVE-2021-24343 · WordPress plugins & themes · reported by WPScanMedium 4.8
The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- iFlyChat
- Fixed in
- 4.7.0
- What to do
- Update iFlyChat to 4.7.0 or newer.
Jun 7, 2021FlightLog: Does not sanitiseCVE-2021-24336 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users
- Product
- FlightLog
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update FlightLog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Jun 1, 2021Content Copy Protection & Prevent Image Save: Does not check for CSRFCVE-2021-24333 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.
- Product
- Content Copy Protection & Prevent Image Save
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Content Copy Protection & Prevent Image Save to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2021search feature of the Mediumish: Does not properly sanitise it's 's' GET parameter before output it back the pageCVE-2021-24316 · WordPress plugins & themes · reported by WPScanMedium 6.1
The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page, leading to the Cross-SIte Scripting issue.
- Product
- search feature of the Mediumish
- Affected
- up to 1.0.47
- What to do
- Affects up to 1.0.47. Update search feature of the Mediumish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2021College publisher Import: Does not check for the uploaded CSV file to importCVE-2021-24254 · WordPress plugins & themes · reported by WPScanHigh 7.2
The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.
- Product
- College publisher Import
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update College publisher Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2021Classyfrieds: Does not properly check the uploaded fileCVE-2021-24253 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.
- Product
- Classyfrieds
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Classyfrieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2021Event Banner: Does not verify the uploaded image fileCVE-2021-24252 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)
- Product
- Event Banner
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Event Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2021Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments: Does not sanitise the invitaion_code GET parameterCVE-2021-24239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
- Product
- Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments
- Fixed in
- 3.7.0.1
- What to do
- Update Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments to 3.7.0.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 22, 2021Goto: Does not sanitise the keywords and start_date GET parameter on its Tour List pageCVE-2021-24235 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.
- Product
- Goto
- Fixed in
- 2.0
- What to do
- Update Goto to 2.0 or newer.
Apr 22, 2021Advanced Booking Calendar: Does not sanitise the license error messageCVE-2021-24232 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue
- Product
- Advanced Booking Calendar
- Fixed in
- 1.6.8
- What to do
- Update Advanced Booking Calendar to 1.6.8 or newer.
Apr 12, 2021The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in pCVE-2021-24224 · WordPress plugins & themes · reported by WPScanHigh 8.8
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
- Product
- Easy Form Builder
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021JH 404 Logger: Doesn't sanitise the referer and path of 404 pagesCVE-2021-24176 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
- Product
- JH 404 Logger
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update JH 404 Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordganofins.comwpscan.com
Apr 5, 2021Database Backups: Does not have CSRF checksCVE-2021-24174 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
- Product
- Database Backups
- Affected
- up to 1.2.2.6
- What to do
- Affects up to 1.2.2.6. Update Database Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 5, 2021VM Backups: Does not have CSRF checksCVE-2021-24173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue.
- Product
- VM Backups
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update VM Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021VM Backups: Does not have CSRF checksCVE-2021-24172 · WordPress plugins & themes · reported by WPScanMedium 4.3
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current .
- Product
- VM Backups
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update VM Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2021The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until tCVE-2020-36176 · WordPress plugins & themes · reported by MITREHigh 7.5
The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.
- Product
- iThemes Security (formerly Better WP Security)
- Fixed in
- 7.7.0
- What to do
- Update iThemes Security (formerly Better WP Security) to 7.7.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 6, 2021The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.CVE-2020-36171 · WordPress plugins & themes · reported by MITREMedium 6.1
The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.
- Product
- Elementor Website Builder
- Fixed in
- 3.0.14
- What to do
- Update Elementor Website Builder to 3.0.14 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 6, 2021The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conducCVE-2012-10001 · WordPress plugins & themes · reported by MITRECritical 9.8
The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts.
- Product
- Limit Login Attempts
- Fixed in
- 1.7.1
- What to do
- Update Limit Login Attempts to 1.7.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.