Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,829 results · page 116 of 117
Nov 1, 2021Restaurant Menu by MotoPress: Does not properly sanitize or escape inputsCVE-2021-24722 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Restaurant Menu by MotoPress
- Fixed in
- 2.4.2
- What to do
- Update Restaurant Menu by MotoPress to 2.4.2 or newer.
Oct 19, 2021WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.CVE-2021-36832 · WordPress plugins & themes · reported by PatchstackMedium 4.8
WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
- Product
- LearnPress
- Fixed in
- 4.1.3.1
- What to do
- Update LearnPress to 4.1.3.1 or newer.
Oct 11, 2021Chained Quiz: Does not properly sanitize or escape inputs in the plugin's settingsCVE-2021-24690 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings.
- Product
- Chained Quiz
- Fixed in
- 1.2.7.2
- What to do
- Update Chained Quiz to 1.2.7.2 or newer.
Oct 11, 2021Coming soon and Maintenance mode: Does not properly sanitize inputs submitted by authenticated usersCVE-2021-24577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.5.3
- What to do
- Update Coming soon and Maintenance mode to 3.5.3 or newer.
Oct 11, 2021Easy Accordion: Does not properly sanitize inputsCVE-2021-24576 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion.
- Product
- Easy Accordion
- Fixed in
- 2.0.22
- What to do
- Update Easy Accordion to 2.0.22 or newer.
Sep 23, 2021AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-36823 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) allows Stored XSS.This issue affects AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): from n/a through 6.8.
- Product
- AGCA - Absolutely Glamorous Custom Admin (WordPress plugin)
- Affected
- up to 6.8
- What to do
- Affects up to 6.8. Update AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 13, 2021create_post_page AJAX action of the Custom Post View Generator: (available to authenticated user) does not sanitise or escape user input before outputting it back in the responseCVE-2021-24605 · WordPress plugins & themes · reported by WPScanMedium 5.4
The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue
- Product
- create_post_page AJAX action of the Custom Post View Generator
- Affected
- up to 0.4.6
- What to do
- Affects up to 0.4.6. Update create_post_page AJAX action of the Custom Post View Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2021Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization optionsCVE-2021-24590 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.
- Product
- Cookie Notice & Consent Banner for GDPR & CCPA Compliance
- Fixed in
- 1.7.2
- What to do
- Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to 1.7.2 or newer.
Aug 30, 2021Side Menu Lite: Does not sanitise user input from the List page in the admin dashboard before using it in SQL statementCVE-2021-24580 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue
- Product
- Side Menu Lite
- Fixed in
- 2.2.6
- What to do
- Update Side Menu Lite to 2.2.6 or newer.
Aug 30, 2021bt_bb_get_grid AJAX action of the Bold Page Builder: Passes user input into the unserialize() function without any validation or sanitisationCVE-2021-24579 · WordPress plugins & themes · reported by WPScanHigh 8.8
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.
- Product
- bt_bb_get_grid AJAX action of the Bold Page Builder
- Fixed in
- 3.1.6
- What to do
- Update bt_bb_get_grid AJAX action of the Bold Page Builder to 3.1.6 or newer.
Aug 23, 2021AceIDE: Does not sanitise or validate the user inputCVE-2021-24549 · WordPress plugins & themes · reported by WPScanMedium 4.9
The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server outside of the blog directory via a path traversal attack.
- Product
- AceIDE
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update AceIDE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 16, 2021Current Book: Does not sanitize user inputCVE-2021-24538 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue.
- Product
- Current Book
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Current Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 9, 2021Side Menu Lite – add sticky fixed buttons: Does not properly sanitize input values from the browserCVE-2021-24521 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
- Product
- Side Menu Lite – add sticky fixed buttons
- Fixed in
- 2.2.1
- What to do
- Update Side Menu Lite – add sticky fixed buttons to 2.2.1 or newer.
Aug 9, 2021Forms: Did not sanitise its input fieldsCVE-2021-24505 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field.
- Product
- Forms
- Fixed in
- 1.12.3
- What to do
- Update Forms to 1.12.3 or newer.
Jul 12, 2021The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request.CVE-2021-24385 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.
- Affected
- 4.7.3 to 4.7.3
- What to do
- Affects 4.7.3 to 4.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2021In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fieCVE-2021-24369 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation.
- Product
- GetPaid
- Fixed in
- 2.3.4
- What to do
- Update GetPaid to 2.3.4 or newer.
Jun 1, 2021Schedule Name" input in the Weekly Schedule: General options did not properly sanitize inputCVE-2021-24309 · WordPress plugins & themes · reported by WPScanMedium 5.4
The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the <script> HTML tags and cause a stored XSS issue
- Product
- Schedule Name" input in the Weekly Schedule
- Fixed in
- 3.4.3
- What to do
- Update Schedule Name" input in the Weekly Schedule to 3.4.3 or newer.
May 14, 2021RSS for Yandex Turbo: Did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the pageCVE-2021-24277 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues
- Product
- RSS for Yandex Turbo
- Fixed in
- 1.30
- What to do
- Update RSS for Yandex Turbo to 1.30 or newer.
May 6, 2021Stop Spammers: Did not escape user inputCVE-2021-24245 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue.
- Product
- Stop Spammers
- Fixed in
- 2021.9
- What to do
- Update Stop Spammers to 2021.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 5, 2021WP Super Cache: Was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location optionCVE-2021-24209 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
- Product
- WP Super Cache
- Fixed in
- 1.7.2
- What to do
- Update WP Super Cache to 1.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 5, 2021Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerabCVE-2021-24180 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.
- Fixed in
- 2.0.4
- What to do
- Update the plugin to 2.0.4 or newer.
Mar 18, 2021Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_fCVE-2021-24149 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.6
- What to do
- Update Modern Events Calendar Lite to 5.16.6 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment fielCVE-2021-24147 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.5
- What to do
- Update Modern Events Calendar Lite to 5.16.5 or newer.
Mar 18, 2021Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitraryCVE-2021-24144 · WordPress plugins & themes · reported by WPScanHigh 7.8
Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files.
- Fixed in
- 1.2.5.6
- What to do
- Update the plugin to 1.2.5.6 or newer.
Mar 18, 2021Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, CVE-2021-24143 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections.
- Fixed in
- 1.8.1
- What to do
- Update the plugin to 1.8.1 or newer.
Mar 18, 2021Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importinCVE-2021-24142 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections.
- Product
- 301 Redirects - Easy Redirect Manager
- Fixed in
- 2.51
- What to do
- Update 301 Redirects - Easy Redirect Manager to 2.51 or newer.
Mar 18, 2021Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL atCVE-2021-24141 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks.
- Fixed in
- 3.0.2
- What to do
- Update the plugin to 3.0.2 or newer.
Mar 18, 2021Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' orCVE-2021-24140 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test.
- Product
- Ajax Load More
- Fixed in
- 5.3.2
- What to do
- Update Ajax Load More to 5.3.2 or newer.
Mar 18, 2021Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php CVE-2021-24139 · WordPress plugins & themes · reported by WPScanCritical 9.8
Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.
- Product
- Photo Gallery (10Web Photo Gallery)
- Fixed in
- 1.5.55
- What to do
- Update Photo Gallery (10Web Photo Gallery) to 1.5.55 or newer.
Mar 18, 2021Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id".CVE-2021-24138 · WordPress plugins & themes · reported by WPScanMedium 5.5
Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user.
- Product
- AdRotate
- Fixed in
- 5.8.4
- What to do
- Update AdRotate to 5.8.4 or newer.
Mar 18, 2021Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users CVE-2021-24137 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands.
- Product
- Blog2Social
- Fixed in
- 6.3.1
- What to do
- Update Blog2Social to 6.3.1 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabCVE-2021-24136 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL
- Product
- Testimonials Widget
- Fixed in
- 4.0.0
- What to do
- Update Testimonials Widget to 4.0.0 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vCVE-2021-24135 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.
- Product
- WP Customer Reviews
- Fixed in
- 3.4.3
- What to do
- Update WP Customer Reviews to 3.4.3 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site ScriptinCVE-2021-24134 · WordPress plugins & themes · reported by WPScanMedium 4.8
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
- Product
- Constant Contact Forms
- Fixed in
- 1.8.8
- What to do
- Update Constant Contact Forms to 1.8.8 or newer.
Mar 18, 2021Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, CVE-2021-24131 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, it requires high privilege user (admin+).
- Product
- Anti-Spam by CleanTalk
- Fixed in
- 5.149
- What to do
- Update Anti-Spam by CleanTalk to 5.149 or newer.
Mar 18, 2021Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable toCVE-2021-24130 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+).
- Product
- WP Google Map
- Fixed in
- 4.1.5
- What to do
- Update WP Google Map to 4.1.5 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vCVE-2021-24129 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.
- Product
- Themify Portfolio Post
- Fixed in
- 1.1.6
- What to do
- Update Themify Portfolio Post to 1.1.6 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowingCVE-2021-24128 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker (contributor+) to inject arbitrary web script or HTML via the 'Description/biography' of a member.
- Product
- Team Members
- Fixed in
- 5.0.4
- What to do
- Update Team Members to 5.0.4 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was vulnerable to authentCVE-2021-24127 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was vulnerable to authenticated Stored Cross-Site Scripting (XSS), which could lead to privilege escalation.
- Product
- ThirstyAffiliates Affiliate Link Manager
- Fixed in
- 3.9.3
- What to do
- Update ThirstyAffiliates Affiliate Link Manager to 3.9.3 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadatCVE-2021-24126 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata (namely title) before outputting them in the generated gallery, which could lead to privilege escalation.
- Product
- Envira Gallery Lite
- Fixed in
- 1.8.3.3
- What to do
- Update Envira Gallery Lite to 1.8.3.3 or newer.
Mar 18, 2021Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitCVE-2021-24125 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitting a filter request as a high privilege user (admin+)
- Product
- Contact Form Submissions
- Fixed in
- 1.7.1
- What to do
- Update Contact Form Submissions to 1.7.1 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site ScriptCVE-2021-24124 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation.
- Product
- WP Shieldon
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update WP Shieldon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 14, 2020Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attackeCVE-2020-25379 · WordPress plugins & themes · reported by MITREHigh 8.8
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query.
- Affected
- 0.8 to 0.8
- What to do
- Affects 0.8 to 0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Aug 26, 2020Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping.CVE-2020-24315 · WordPress plugins & themes · reported by MITREHigh 7.5
Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database.
- Affected
- up to 36.0
- What to do
- Affects up to 36.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgzeroaptitude.com
Aug 26, 2020Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag.CVE-2020-24314 · WordPress plugins & themes · reported by MITREMedium 6.1
Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgzeroaptitude.com
Apr 4, 2020The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula.CVE-2020-11548 · WordPress plugins & themes · reported by MITRECritical 9.8
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
- Product
- Search Meter
- Affected
- up to 2.13.2
- What to do
- Affects up to 2.13.2. Update Search Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Mar 4, 2020The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formCVE-2020-9372 · WordPress plugins & themes · reported by MITREHigh 7.8
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
- Product
- Appointment Booking Calendar
- Fixed in
- 1.3.35
- What to do
- Update Appointment Booking Calendar to 1.3.35 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Jan 22, 2020The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms.CVE-2020-7228 · WordPress plugins & themes · reported by MITREMedium 5.4
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.
- Product
- Calculated Fields Form
- Affected
- up to 1.0.353
- What to do
- Affects up to 1.0.353. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordspider-security.co.ukwordpress.org
Dec 27, 2019wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization,CVE-2019-20041 · WordPress plugins & themes · reported by MITRECritical 9.8
wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.
- Fixed in
- 5.3.1
- What to do
- Update the plugin to 5.3.1 or newer.
Full record and what to do →NVD recordgithub.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.