Updated 14 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

982 results · page 17 of 20

Feb 7, 2022All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs: Was vulnerable to reflected XSS on the my-sticky-elements-leads admin pageCVE-2022-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
Product
All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs
Fixed in
2.0.4
What to do
Update All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs to 2.0.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 4, 2022Embed Swagger: Reflected Cross-Site ScriptingCVE-2022-0381 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.
Product
Embed Swagger
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Embed Swagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 4, 2022Fotobook: Reflected Cross-Site ScriptingCVE-2022-0380 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF'] found in the ~/options-fotobook.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 3.2.3.
Product
Fotobook
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Fotobook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2022Landing Page Builder: Was affected by a reflected XSS in page-builder-add on the ulpb_post admin pageCVE-2021-25067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.
Product
Landing Page Builder
Fixed in
1.4.9.6
What to do
Update Landing Page Builder to 1.4.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022Smash Balloon Social Post Feed: Was affected by a reflected XSS in custom-facebook-feed in cff-top admin pageCVE-2021-25065 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
Product
Smash Balloon Social Post Feed
Fixed in
4.1.1
What to do
Update Smash Balloon Social Post Feed to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022WP Booking System: Was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin pageCVE-2021-25061 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.
Product
WP Booking System
Fixed in
2.0.15
What to do
Update WP Booking System to 2.0.15 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Reflected cross-site scriptingCVE-2022-0181 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Jan 14, 2022Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).CVE-2021-36920 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jan 10, 202210Web Social Photo Feed: Was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin pageCVE-2021-25047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users
Product
10Web Social Photo Feed
Fixed in
1.4.29
What to do
Update 10Web Social Photo Feed to 1.4.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 14, 2021duoFAQ - Responsive, Flat, Simple FAQ WordPess: Reflected Cross-Site ScriptingCVE-2021-39319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.
Product
duoFAQ - Responsive, Flat, Simple FAQ WordPess
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update duoFAQ - Responsive, Flat, Simple FAQ WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021H5P CSS Editor: Reflected Cross-Site ScriptingCVE-2021-39318 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
H5P CSS Editor
Affected
up to 1.0
What to do
Affects up to 1.0. Update H5P CSS Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Magic Post Voice: Reflected Cross-Site ScriptingCVE-2021-39315 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
Magic Post Voice
Affected
up to 1.2
What to do
Affects up to 1.2. Update Magic Post Voice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021WooCommerce EnvioPack: Reflected Cross-Site ScriptingCVE-2021-39314 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
WooCommerce EnvioPack
Affected
up to 1.2
What to do
Affects up to 1.2. Update WooCommerce EnvioPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Simple Image Gallery: Reflected Cross-Site ScriptingCVE-2021-39313 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
Product
Simple Image Gallery
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Simple Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021link-list-manager: Reflected Cross-Site ScriptingCVE-2021-39311 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
link-list-manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update link-list-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Real WYSIWYG: Reflected Cross-Site ScriptingCVE-2021-39310 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2.
Product
Real WYSIWYG
Affected
up to 0.0.2
What to do
Affects up to 0.0.2. Update Real WYSIWYG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Parsian Bank Gateway for Woocommerce: Reflected Cross-Site ScriptingCVE-2021-39309 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parameter due to a var_dump() on $_POST variables found in the ~/vendor/dpsoft/parsian-payment/sample/rollback-payment.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
Parsian Bank Gateway for Woocommerce
Affected
up to 1.0
What to do
Affects up to 1.0. Update Parsian Bank Gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021WooCommerce myghpay Payment Gateway WordPess: Reflected Cross-Site ScriptingCVE-2021-39308 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the ~/processresponse.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.0.
Product
WooCommerce myghpay Payment Gateway WordPess
Affected
up to 3.0
What to do
Affects up to 3.0. Update WooCommerce myghpay Payment Gateway WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021.htaccess Redirect: Reflected Cross-Site ScriptingCVE-2021-38361 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redirect.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.3.1.
Product
.htaccess Redirect
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update .htaccess Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-SiCVE-2021-42549 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.15.3
What to do
Update search functionality of to 1.15.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected CCVE-2021-42548 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.15.3
What to do
Update search functionality of to 1.15.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected CrCVE-2021-42547 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.20.3
What to do
Update search functionality of to 1.20.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected CrCVE-2021-42546 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.18.3
What to do
Update search functionality of to 1.18.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 6, 2021The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcCVE-2021-25041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action
Product
Photo Gallery by 10Web
Fixed in
1.5.68
What to do
Update Photo Gallery by 10Web to 1.5.68 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 26, 2021Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id,CVE-2021-36919 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 19, 2021Preview E-Mails for WooCommerce: Reflected Cross-Site ScriptingCVE-2021-42363 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8.
Product
Preview E-Mails for WooCommerce
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Preview E-Mails for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2021plugins/wordpress_sso/pages/index.php: ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site ScriptingCVE-2021-41951 · WordPress plugins & themes · reported by MITREMedium 6.1
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.
Product
plugins/wordpress_sso/pages/index.php
Fixed in
9.6
What to do
Update plugins/wordpress_sso/pages/index.php to 9.6 or newer.
Full record and what to do →NVD record horizon3.ai horizon3.ai
Nov 1, 2021NextScripts: Social Networks Auto-Poster <= 4.3.20: Reflected Cross-Site ScriptingCVE-2021-38356 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['page'] parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load the page in $_GET['page'] along with malicious JavaScript in $_POST['page'].
Product
NextScripts: Social Networks Auto-Poster <= 4.3.20
Affected
up to 4.3.20
What to do
Affects up to 4.3.20. Update NextScripts: Social Networks Auto-Poster <= 4.3.20 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Oct 21, 2021WordPress Ivory Search: Reflected Cross-Site Scripting (XSS)CVE-2021-36869 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post.
Product
WordPress Ivory Search
Affected
up to 4.6.6
What to do
Affects up to 4.6.6. Update WordPress Ivory Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Oct 21, 2021Easy Digital Downloads: Reflected Cross-Site ScriptingCVE-2021-39354 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.
Product
Easy Digital Downloads
Affected
up to 2.11.2
What to do
Affects up to 2.11.2. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 11, 2021Enfold Enfold: Was vulnerable to Reflected Cross-Site Scripting (XSS)CVE-2021-24719 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder.
Product
Enfold Enfold
Fixed in
4.8.4
What to do
Update Enfold Enfold to 4.8.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Oct 6, 2021FV Flowplayer Video Player: Reflected Cross-Site ScriptingCVE-2021-39350 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.
Product
FV Flowplayer Video Player
Affected
7.5.0.727 to 7.5.2.727
What to do
Affects 7.5.0.727 to 7.5.2.727. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 20, 2021eID Easy: Reflected Cross-Site ScriptingCVE-2021-34650 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6.
Product
eID Easy
Affected
up to 4.6
What to do
Affects up to 4.6. Update eID Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 20, 2021OptinMonster: Reflected Cross-Site ScriptingCVE-2021-39325 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.6.0.
Product
OptinMonster
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021WordPress InviteBox Plugin for viral Refer-a-Friend Promotions: Reflected Cross-Site ScriptingCVE-2021-38359 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1.
Product
WordPress InviteBox Plugin for viral Refer-a-Friend Promotions
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update WordPress InviteBox Plugin for viral Refer-a-Friend Promotions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021MoolaMojo: Reflected Cross-Site ScriptingCVE-2021-38358 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1.
Product
MoolaMojo
Affected
up to 0.7.4.1
What to do
Affects up to 0.7.4.1. Update MoolaMojo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021SMS OVH: Reflected Cross-Site ScriptingCVE-2021-38357 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.
Product
SMS OVH
Affected
up to 0.1
What to do
Affects up to 0.1. Update SMS OVH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Bug Library: Reflected Cross-Site ScriptingCVE-2021-38355 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3.
Product
Bug Library
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Bug Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021GNU-Mailman Integration: Reflected Cross-Site ScriptingCVE-2021-38354 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
Product
GNU-Mailman Integration
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update GNU-Mailman Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Dropdown and scrollable Text: Reflected Cross-Site ScriptingCVE-2021-38353 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.
Product
Dropdown and scrollable Text
Affected
up to 2.0
What to do
Affects up to 2.0. Update Dropdown and scrollable Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Feedify – Web Push Notifications: Reflected Cross-Site ScriptingCVE-2021-38352 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8.
Product
Feedify – Web Push Notifications
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021OSD Subscribe: Reflected Cross-Site ScriptingCVE-2021-38351 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe_options_subscribers.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.3.
Product
OSD Subscribe
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update OSD Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021spideranalyse: Reflected Cross-Site ScriptingCVE-2021-38350 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1.
Product
spideranalyse
Affected
up to 0.0.1
What to do
Affects up to 0.0.1. Update spideranalyse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Integration of Moneybird for WooCommerce: Reflected Cross-Site ScriptingCVE-2021-38349 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1.
Product
Integration of Moneybird for WooCommerce
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Integration of Moneybird for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Advance Search: Reflected Cross-Site ScriptingCVE-2021-38348 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.2.
Product
Advance Search
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Advance Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Custom Website Data: Reflected Cross-Site ScriptingCVE-2021-38347 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.
Product
Custom Website Data
Affected
up to 2.2
What to do
Affects up to 2.2. Update Custom Website Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021WooCommerce Payment Gateway Per Category: Reflected Cross-Site ScriptingCVE-2021-38341 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10.
Product
WooCommerce Payment Gateway Per Category
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update WooCommerce Payment Gateway Per Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Wordpress Simple Shop: Reflected Cross-Site ScriptingCVE-2021-38340 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
Wordpress Simple Shop
Affected
up to 1.2
What to do
Affects up to 1.2. Update Wordpress Simple Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Simple Matted Thumbnails: Reflected Cross-Site ScriptingCVE-2021-38339 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.01.
Product
Simple Matted Thumbnails
Affected
up to 1.01
What to do
Affects up to 1.01. Update Simple Matted Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Border Loading Bar: Reflected Cross-Site ScriptingCVE-2021-38338 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
Product
Border Loading Bar
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Border Loading Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.