Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
856 results · page 16 of 18
Oct 31, 2022WP Total Hacks: Does not prevent low privilege users from modifying the plugin's settingsCVE-2022-3096 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other users, like administrators, due to the lack of sanitisation and escaping as well.
- Product
- WP Total Hacks
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update WP Total Hacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 21, 2022Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.CVE-2022-36390 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 19, 2022Site Offline Or Coming Soon Or Maintenance Mode: Prevents users from accessing a website but does not do so if the URL contained certain keywordsCVE-2022-1580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
- Product
- Site Offline Or Coming Soon Or Maintenance Mode
- Fixed in
- 1.5.3
- What to do
- Update Site Offline Or Coming Soon Or Maintenance Mode to 1.5.3 or newer.
Sep 16, 2022Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation.CVE-2022-29489 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation.
- Affected
- up to 1.8.33
- What to do
- Affects up to 1.8.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 16, 2022Mobile Events Manager: Does not properly escape the Enquiry source fieldCVE-2022-1194 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
- Product
- Mobile Events Manager
- Fixed in
- 1.4.8
- What to do
- Update Mobile Events Manager to 1.4.8 or newer.
Sep 9, 2022Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.CVE-2022-38067 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 29, 2022Stop Spam Comments: Does not properly generate the Javascript access token for preventing abuse of comment sectionCVE-2022-1663 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
- Product
- Stop Spam Comments
- Affected
- up to 0.2.1.2
- What to do
- Affects up to 0.2.1.2. Update Stop Spam Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2022Calendar Event Multi View: Does not have any authorisation and CSRF checks in placeCVE-2022-2846 · WordPress plugins & themes · reported by VulDBMedium 4.3
The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.
- Product
- Calendar Event Multi View
- Fixed in
- 1.4.07
- What to do
- Update Calendar Event Multi View to 1.4.07 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Aug 15, 2022WP-DBManager: Does not prevent administrators from running arbitrary commands on the server in multisite installationsCVE-2022-2354 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.
- Product
- WP-DBManager
- Fixed in
- 2.80.8
- What to do
- Update WP-DBManager to 2.80.8 or newer.
Aug 1, 2022Microsoft Advertising Universal Event Tracking (UET): Does not sanitise and escape its settingsCVE-2022-2170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
- Product
- Microsoft Advertising Universal Event Tracking (UET)
- Fixed in
- 1.0.4
- What to do
- Update Microsoft Advertising Universal Event Tracking (UET) to 1.0.4 or newer.
Aug 1, 2022Event Timeline: Does not sanitize and escape Timeline TextCVE-2022-1324 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Event Timeline
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Event Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022WP Event Manager: Does not sanitise and escape its search before outputting it back in an attribute on the event dashboardCVE-2022-1474 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting
- Product
- WP Event Manager
- Fixed in
- 3.1.28
- What to do
- Update WP Event Manager to 3.1.28 or newer.
Jun 20, 2022Events Made Easy: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1905 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Events Made Easy
- Fixed in
- 2.2.81
- What to do
- Update Events Made Easy to 2.2.81 or newer.
May 30, 2022External Links in New Window / New Tab: Does not properly escape URLs it concatenates to onclick event handlersCVE-2022-1582 · WordPress plugins & themes · reported by WPScanMedium 6.1
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
- Product
- External Links in New Window / New Tab
- Fixed in
- 1.43
- What to do
- Update External Links in New Window / New Tab to 1.43 or newer.
May 2, 2022Event List: Does not sanitise and escape some of its settingsCVE-2022-0418 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks against other admin even when the unfiltered_html is disallowed
- Product
- Event List
- Fixed in
- 0.8.8
- What to do
- Update Event List to 0.8.8 or newer.
Apr 18, 2022RSVP and Event Management: Does not have any authorisation checksCVE-2022-1054 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
- Product
- RSVP and Event Management
- Fixed in
- 2.7.8
- What to do
- Update RSVP and Event Management to 2.7.8 or newer.
Apr 18, 2022Loco Translate: Does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panelCVE-2022-0765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
- Product
- Loco Translate
- Fixed in
- 2.6.1
- What to do
- Update Loco Translate to 2.6.1 or newer.
Apr 14, 2022Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1CVE-2022-27848 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 25, 2022Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higherCVE-2022-25612 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact].
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 25, 2022Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malCVE-2022-25611 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][].
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 21, 2022Modern Events Calendar Lite: Does not sanitize and escape some of the Hourly Schedule parametersCVE-2022-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.4.0
- What to do
- Update Modern Events Calendar Lite to 6.4.0 or newer.
Mar 14, 2022Event Manager and Tickets Selling for WooCommerce: Does not validate and escape the post_author_gutenberg parameter before using it in a SQL statementCVE-2022-0478 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacks
- Product
- Event Manager and Tickets Selling for WooCommerce
- Fixed in
- 3.5.8
- What to do
- Update Event Manager and Tickets Selling for WooCommerce to 3.5.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022WP Event Manager: Does not escape some of its Field Editor settingsCVE-2021-24810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- WP Event Manager
- Fixed in
- 3.1.23
- What to do
- Update WP Event Manager to 3.1.23 or newer.
Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).CVE-2022-25599 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jan 24, 2022Registrations for the Events Calendar: Does not escape the qtype parameter before outputting it back in an attribute in the settings pageCVE-2021-25083 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.7.10
- What to do
- Update Registrations for the Events Calendar to 2.7.10 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Mobile Events Manager: Does not sanitise and escape various of its settingsCVE-2021-25049 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Mobile Events Manager
- Fixed in
- 1.4.4
- What to do
- Update Mobile Events Manager to 1.4.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Event Tickets: Does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given valueCVE-2021-25028 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
- Product
- Event Tickets
- Fixed in
- 5.2.2
- What to do
- Update Event Tickets to 5.2.2 or newer.
Jan 17, 2022Modern Events Calendar Lite: Alloed any logged-in userCVE-2021-25046 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.2.0
- What to do
- Update Modern Events Calendar Lite to 6.2.0 or newer.
Jan 17, 2022EventCalendar: Does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actionsCVE-2021-25025 · WordPress plugins & themes · reported by WPScanMedium 4.3
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
- Product
- EventCalendar
- Fixed in
- 1.1.51
- What to do
- Update EventCalendar to 1.1.51 or newer.
Jan 17, 2022EventCalendar: Does not escape some user input before outputting it back in attributesCVE-2021-25024 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
- Product
- EventCalendar
- Fixed in
- 1.1.51
- What to do
- Update EventCalendar to 1.1.51 or newer.
Jan 3, 2022Events Made Easy: Does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX actionCVE-2021-25030 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks
- Product
- Events Made Easy
- Fixed in
- 2.2.36
- What to do
- Update Events Made Easy to 2.2.36 or newer.
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Tickera
- Fixed in
- 3.4.8.3
- What to do
- Update Tickera to 3.4.8.3 or newer.
Dec 21, 2021SportsPress: Does not sanitise and escape its match_day parameter before outputting back in the Events backend pageCVE-2021-24578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue
- Product
- SportsPress
- Fixed in
- 2.7.9
- What to do
- Update SportsPress to 2.7.9 or newer.
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX actionCVE-2021-24946 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.1.5
- What to do
- Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.1.5
- What to do
- Update Modern Events Calendar Lite to 6.1.5 or newer.
Dec 6, 2021Registrations for the Events Calendar: Does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2021-24943 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.7.6
- What to do
- Update Registrations for the Events Calendar to 2.7.6 or newer.
Dec 1, 2021Events Manager: Does not sanitise and escape some search parameter before outputing them in pagesCVE-2020-35037 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues
- Product
- Events Manager
- Fixed in
- 5.9.8
- What to do
- Update Events Manager to 5.9.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 1, 2021Events Manager: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2020-35012 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection
- Product
- Events Manager
- Fixed in
- 5.9.8
- What to do
- Update Events Manager to 5.9.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 29, 2021Registrations for the Events Calendar: Does not escape the v parameter before outputting it back in an attributeCVE-2021-24876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.7.5
- What to do
- Update Registrations for the Events Calendar to 2.7.5 or newer.
Nov 1, 2021Events Made Easy: Does not sanitise and escape Custom Field NamesCVE-2021-24813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Events Made Easy
- Fixed in
- 2.2.24
- What to do
- Update Events Made Easy to 2.2.24 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.3
- What to do
- Update Modern Events Calendar Lite to 5.22.3 or newer.
Oct 11, 2021Frontend Uploader: Does not prevent HTML files from being uploaded via its formCVE-2021-24563 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
- Product
- Frontend Uploader
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Frontend Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.2
- What to do
- Update Modern Events Calendar Lite to 5.22.2 or newer.
Sep 20, 2021Timetable and Event Schedule: Outputs the Hashed PasswordCVE-2021-24585 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.0
- What to do
- Update Timetable and Event Schedule to 2.4.0 or newer.
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24584 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.2
- What to do
- Update Timetable and Event Schedule to 2.4.2 or newer.
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24583 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.2
- What to do
- Update Timetable and Event Schedule to 2.4.2 or newer.
Sep 13, 2021Timetable and Event Schedule by MotoPress: Does not sanitise some of its parametersCVE-2021-24724 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
- Product
- Timetable and Event Schedule by MotoPress
- Fixed in
- 2.3.19
- What to do
- Update Timetable and Event Schedule by MotoPress to 2.3.19 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 6, 2021Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization optionsCVE-2021-24590 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.
- Product
- Cookie Notice & Consent Banner for GDPR & CCPA Compliance
- Fixed in
- 1.7.2
- What to do
- Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to 1.7.2 or newer.
Aug 23, 2021HM Multiple Roles: Does not have any access control to prevent low privilege users to set themselvesCVE-2021-24602 · WordPress plugins & themes · reported by WPScanHigh 8.8
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
- Product
- HM Multiple Roles
- Fixed in
- 1.3
- What to do
- Update HM Multiple Roles to 1.3 or newer.
Aug 23, 2021Simple Events Calendar: Does not sanitiseCVE-2021-24552 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue
- Product
- Simple Events Calendar
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Simple Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.