Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
766 results · page 14 of 16
Sep 5, 2022Simple Single Sign On: Leaks its OAuth client_secretCVE-2022-2083 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the site.
- Product
- Simple Single Sign On
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Simple Single Sign On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 1, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress.CVE-2022-36373 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress.
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 29, 2022Simply Schedule Appointments: Does not sanitise and escape some of its settingsCVE-2022-2374 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simply Schedule Appointments
- Fixed in
- 1.5.7.7
- What to do
- Update Simply Schedule Appointments to 1.5.7.7 or newer.
Aug 29, 2022Simply Schedule Appointments: Is missing authorisation in a REST endpointCVE-2022-2373 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address
- Product
- Simply Schedule Appointments
- Fixed in
- 1.5.7.7
- What to do
- Update Simply Schedule Appointments to 1.5.7.7 or newer.
Aug 22, 2022Simple Job Board: Is susceptible to Directory ListingCVE-2022-2558 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations.
- Product
- Simple Job Board
- Fixed in
- 2.10.0
- What to do
- Update Simple Job Board to 2.10.0 or newer.
Aug 22, 2022Simple Banner: Does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2022-0446 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Banner
- Fixed in
- 2.12.0
- What to do
- Update Simple Banner to 2.12.0 or newer.
Aug 1, 2022Simple Membership: Allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameterCVE-2022-2317 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.
- Product
- Simple Membership
- Fixed in
- 4.1.3
- What to do
- Update Simple Membership to 4.1.3 or newer.
Aug 1, 2022Simple Membership: Does not properly validate the membership_level parameterCVE-2022-2273 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.
- Product
- Simple Membership
- Fixed in
- 4.1.3
- What to do
- Update Simple Membership to 4.1.3 or newer.
Jul 25, 2022Simple Page Transition: Does not sanitise and escape some of its settingsCVE-2022-2341 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Page Transition
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Simple Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2022Simple Post Notes: Does not sanitise and escape its settingsCVE-2022-2186 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Post Notes
- Fixed in
- 1.7.6
- What to do
- Update Simple Post Notes to 1.7.6 or newer.
Jul 17, 2022Very Simple Breadcrumb: Does not sanitise and escape its settingsCVE-2022-2149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Very Simple Breadcrumb WordPress plugin through 1.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Very Simple Breadcrumb
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Very Simple Breadcrumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Very Simple Contact Form: Exposes the solution to the captcha in the rendered contact formCVE-2022-1801 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.
- Product
- Very Simple Contact Form
- Fixed in
- 11.6
- What to do
- Update Very Simple Contact Form to 11.6 or newer.
Jun 13, 2022Simple Membership: Does not properly sanitise and escape parameters before outputting them back in AJAX actionsCVE-2022-1724 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
- Product
- Simple Membership
- Fixed in
- 4.1.1
- What to do
- Update Simple Membership to 4.1.1 or newer.
Jun 8, 2022WP Simple Adsense Insertion: Does not perform CSRF checks on updates to its admin pageCVE-2022-1695 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form.
- Product
- WP Simple Adsense Insertion
- Fixed in
- 2.1
- What to do
- Update WP Simple Adsense Insertion to 2.1 or newer.
May 30, 2022Simple Real Estate Pack: Does not sanitise and escape some of its settingsCVE-2022-1646 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Simple Real Estate Pack
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Simple Real Estate Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 19, 2022Simple File List: Arbitrary File DownloadCVE-2022-1119 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.
- Product
- Simple File List
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.google.complugins.trac.wordpress.org
Apr 15, 2022Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message.CVE-2022-27850 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message.
- Affected
- up to 20220115
- What to do
- Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 15, 2022Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115CVE-2022-27849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115
- Affected
- up to 20220115
- What to do
- Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 25, 2022Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higherCVE-2022-25612 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact].
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 25, 2022Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malCVE-2022-25611 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][].
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 25, 2022Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code.CVE-2022-25610 · WordPress plugins & themes · reported by PatchstackLow 3.4
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.
- Affected
- up to 20220115
- What to do
- Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 21, 2022Simple Link Directory: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0760 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
- Product
- Simple Link Directory
- Fixed in
- 7.7.2
- What to do
- Update Simple Link Directory to 7.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Simple Membership: Does not have CSRF check in placeCVE-2022-0681 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack
- Product
- Simple Membership
- Fixed in
- 4.1.0
- What to do
- Update Simple Membership to 4.1.0 or newer.
Mar 14, 2022Simple Quotation: Does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user dataCVE-2022-22735 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks
- Product
- Simple Quotation
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Simple Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Simple Quotation: Does not have CSRF checkCVE-2022-22734 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them
- Product
- Simple Quotation
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Simple Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Simple Tracking: Does not sanitise and escape its settingsCVE-2022-0700 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Simple Tracking
- Fixed in
- 1.7
- What to do
- Update Simple Tracking to 1.7 or newer.
Mar 14, 2022Simple Download Monitor: Allows users with a roleCVE-2021-24692 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector.
- Product
- Simple Download Monitor
- Fixed in
- 3.9.5
- What to do
- Update Simple Download Monitor to 3.9.5 or newer.
Feb 28, 2022Simple Membership: Does not have CSRF checkCVE-2022-0328 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Simple Membership
- Fixed in
- 4.0.9
- What to do
- Update Simple Membership to 4.0.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Simple Download Monitor: Does not enforce nonce checksCVE-2021-24696 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads
- Product
- Simple Download Monitor
- Fixed in
- 3.9.9
- What to do
- Update Simple Download Monitor to 3.9.9 or newer.
Jan 24, 2022Simple Download Monitor: Could allow users with a roleCVE-2021-24694 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1) "color" or "css_class" argument of sdm_download shortcode, 2) "class" or "placeholder" argument of sdm_search_form shortcode.
- Product
- Simple Download Monitor
- Fixed in
- 3.9.11
- What to do
- Update Simple Download Monitor to 3.9.11 or newer.
Dec 27, 2021Simple JWT Login: Can be used to create new WordPress user accounts with a randomly generated passwordCVE-2021-24998 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.
- Product
- Simple JWT Login
- Fixed in
- 3.3.0
- What to do
- Update Simple JWT Login to 3.3.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 14, 2021duoFAQ - Responsive, Flat, Simple FAQ WordPess: Reflected Cross-Site ScriptingCVE-2021-39319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.
- Product
- duoFAQ - Responsive, Flat, Simple FAQ WordPess
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update duoFAQ - Responsive, Flat, Simple FAQ WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 14, 2021Simple Image Gallery: Reflected Cross-Site ScriptingCVE-2021-39313 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
- Product
- Simple Image Gallery
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Simple Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 17, 2021Simple JWT Login: Does not have nonce checksCVE-2021-24804 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.
- Product
- Simple JWT Login
- Fixed in
- 3.2.1
- What to do
- Update Simple JWT Login to 3.2.1 or newer.
Nov 8, 2021Simple Download Monitor: Allows users with a roleCVE-2021-24698 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.
- Product
- Simple Download Monitor
- Fixed in
- 3.9.6
- What to do
- Update Simple Download Monitor to 3.9.6 or newer.
Nov 8, 2021Simple Download Monitor: Does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributesCVE-2021-24697 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Simple Download Monitor
- Fixed in
- 3.9.5
- What to do
- Update Simple Download Monitor to 3.9.5 or newer.
Nov 8, 2021Simple Download Monitor: Saves logs in a predictable locationCVE-2021-24695 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
- Product
- Simple Download Monitor
- Fixed in
- 3.9.6
- What to do
- Update Simple Download Monitor to 3.9.6 or newer.
Nov 8, 2021Simple Download Monitor: Does not escape the "File Thumbnail" post meta before outputting it in some pagesCVE-2021-24693 · WordPress plugins & themes · reported by WPScanCritical 9
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
- Product
- Simple Download Monitor
- Fixed in
- 3.9.5
- What to do
- Update Simple Download Monitor to 3.9.5 or newer.
Nov 8, 2021Similar Posts: Allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDITCVE-2021-24537 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML set to true) via the 'widget_rrm_similar_posts_condition' widget setting of the plugin.
- Product
- Similar Posts
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Similar Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2021Simple Job Board: Stored Cross-Site ScriptingCVE-2021-39328 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Simple Job Board
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 11, 2021Simple Social Media Share Buttons: Does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used)CVE-2021-24656 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Social Media Share Buttons
- Fixed in
- 3.2.4
- What to do
- Update Simple Social Media Share Buttons to 3.2.4 or newer.
Sep 20, 2021Simple Schools Staff Directory: Does not validate uploaded logo pictures to ensure that are indeed imagesCVE-2021-24663 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE
- Product
- Simple Schools Staff Directory
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple Schools Staff Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021WP Simple Booking Calendar: Did not escapeCVE-2021-24726 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue
- Product
- WP Simple Booking Calendar
- Fixed in
- 2.0.6
- What to do
- Update WP Simple Booking Calendar to 2.0.6 or newer.
Full record and what to do →NVD recordwpscan.comtrustwave.com
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
- Product
- WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2021Wordpress Simple Shop: Reflected Cross-Site ScriptingCVE-2021-38340 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
- Product
- Wordpress Simple Shop
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Wordpress Simple Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Simple Matted Thumbnails: Reflected Cross-Site ScriptingCVE-2021-38339 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.01.
- Product
- Simple Matted Thumbnails
- Affected
- up to 1.01
- What to do
- Affects up to 1.01. Update Simple Matted Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021simpleSAMLphp Authentication: Reflected Cross-Site ScriptingCVE-2021-38320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.0.
- Product
- simpleSAMLphp Authentication
- Affected
- up to 0.7.0
- What to do
- Affects up to 0.7.0. Update simpleSAMLphp Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 30, 2021A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below).CVE-2021-24667 · WordPress plugins & themes · reported by WPScanMedium 5.4
A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below). The vulnerability exists in the Lightbox functionality where a user with low privileges is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of image parameters in meta data.
- Fixed in
- 2.2.1
- What to do
- Update the plugin to 2.2.1 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Aug 23, 2021Simple Banner: Does not sanitise and escape one of its settingsCVE-2021-24574 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfiltered_html capability is disallowed.
- Product
- Simple Banner
- Fixed in
- 2.10.4
- What to do
- Update Simple Banner to 2.10.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 23, 2021Simple Events Calendar: Does not sanitiseCVE-2021-24552 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue
- Product
- Simple Events Calendar
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Simple Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.