Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

9,148 results · page 175 of 183

May 6, 2021Business Directory Plugin – Easy Listing Directories for: Did not properly check for imported filesCVE-2021-24248 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11.1
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from a Cross-Site Request Forgery issueCVE-2021-24179 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE.
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from Cross-Site Request Forgery issuesCVE-2021-24178 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing an attacker to make a logged in administrator add, edit or delete form fields, which could also lead to Stored Cross-Site Scripting issues.
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11.1
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 5, 2021Clever Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Clever Addons for Elementor
Fixed in
2.1.0
What to do
Update Clever Addons for Elementor to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021fitness calculators: Add calculators for Water intakeCVE-2021-24272 · WordPress plugins & themes · reported by WPScanMedium 4.3
The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue
Product
fitness calculators
Fixed in
1.9.6
What to do
Update fitness calculators to 1.9.6 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 5, 2021Ultimate Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Ultimate Addons for Elementor
Fixed in
1.30.0
What to do
Update Ultimate Addons for Elementor to 1.30.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021DeTheme Kit for Elementor: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24270 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
DeTheme Kit for Elementor
Fixed in
1.5.5.5
What to do
Update DeTheme Kit for Elementor to 1.5.5.5 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Sina Extension for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24269 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Sina Extension for Elementor
Fixed in
3.3.12
What to do
Update Sina Extension for Elementor to 3.3.12 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021JetWidgets For Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24268 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
JetWidgets For Elementor
Fixed in
1.0.9
What to do
Update JetWidgets For Elementor to 1.0.9 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021All-in-One Addons for Elementor – WidgetKit: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24267 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
All-in-One Addons for Elementor – WidgetKit
Fixed in
2.3.10
What to do
Update All-in-One Addons for Elementor – WidgetKit to 2.3.10 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021The Plus Addons for Elementor Page Builder Lite: Has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24266 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
The Plus Addons for Elementor Page Builder Lite
Fixed in
2.0.6
What to do
Update The Plus Addons for Elementor Page Builder Lite to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Rife Elementor Extensions & Templates: Has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24265 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Rife Elementor Extensions & Templates
Fixed in
1.1.6
What to do
Update Rife Elementor Extensions & Templates to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Image Hover Effects – Elementor Addon: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24264 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Image Hover Effects – Elementor Addon
Fixed in
1.3.4
What to do
Update Image Hover Effects – Elementor Addon to 1.3.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor Addons – PowerPack Addons for Elementor: For WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24263 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addons – PowerPack Addons for Elementor
Fixed in
2.3.2
What to do
Update Elementor Addons – PowerPack Addons for Elementor to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021WooLentor – WooCommerce Elementor Addons + Builder: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24262 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
WooLentor – WooCommerce Elementor Addons + Builder
Fixed in
1.8.6
What to do
Update WooLentor – WooCommerce Elementor Addons + Builder to 1.8.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021HT Mega – Absolute Addons for Elementor Page Builder: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24261 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
HT Mega – Absolute Addons for Elementor Page Builder
Fixed in
1.5.7
What to do
Update HT Mega – Absolute Addons for Elementor Page Builder to 1.5.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Livemesh Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24260 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Livemesh Addons for Elementor
Fixed in
6.8
What to do
Update Livemesh Addons for Elementor to 6.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor Addon Elements: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24259 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addon Elements
Fixed in
1.11.2
What to do
Update Elementor Addon Elements to 1.11.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lCVE-2021-24258 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Fixed in
2.2.0
What to do
Update the plugin to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Premium Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24257 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Premium Addons for Elementor
Fixed in
4.2.8
What to do
Update Premium Addons for Elementor to 4.2.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor – Header, Footer & Blocks Template: Has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24256 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor – Header, Footer & Blocks Template
Fixed in
1.5.8
What to do
Update Elementor – Header, Footer & Blocks Template to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Essential Addons for Elementor Lite: Has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24255 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.
Product
Essential Addons for Elementor Lite
Fixed in
4.5.4
What to do
Update Essential Addons for Elementor Lite to 4.5.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 27, 2021WP Fastest Cache versions prior to 0.9.1.7: Directory traversalCVE-2021-20714 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in WP Fastest Cache versions prior to 0.9.1.7 allows a remote attacker with administrator privileges to delete arbitrary files on the server via unspecified vectors.
Product
WP Fastest Cache versions prior to 0.9.1.7
Fixed in
0.9.1.7
What to do
Update WP Fastest Cache versions prior to 0.9.1.7 to 0.9.1.7 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · WordPress plugins & themes · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.8.8
What to do
Update Tutor LMS – eLearning and online course solution to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page.CVE-2021-24211 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.
Product
WordPress Related Posts
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update WordPress Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021editor of the WP Page Builder: Allows lower-privileged users to insert unfiltered HTMLCVE-2021-24208 · WordPress plugins & themes · reported by WPScanMedium 5.4
The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets (though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side validation but not server side validation), all of which are added via the “page_builder_data” parameter when performing the “wppb_page_save” AJAX action. It is also possible to insert malicious JavaScript via the “wppb_page_css” parameter (this can be done by closing out the style tag and opening a script tag) when performing the “wppb_page_save” AJAX action.
Product
editor of the WP Page Builder
Fixed in
1.2.4
What to do
Update editor of the WP Page Builder to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com themeum.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter.CVE-2021-24206 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter.CVE-2021-24205 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter.CVE-2021-24204 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter.CVE-2021-24203 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter.CVE-2021-24202 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter.CVE-2021-24201 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24186 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24185 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Product
tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify coursCVE-2021-24184 · WordPress plugins & themes · reported by WPScanHigh 8.8
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24183 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24182 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24181 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Product
tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Plus Addons for Elementor Page Builder: Was being actively exploited to by malicious actors to bypass authenticationCVE-2021-24175 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
Product
Plus Addons for Elementor Page Builder
Fixed in
4.1.7
What to do
Update Plus Addons for Elementor Page Builder to 4.1.7 or newer.
Full record and what to do →NVD record posimyth.ticksy.com wpscan.com
Apr 5, 2021When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wtsCVE-2021-24167 · WordPress plugins & themes · reported by WPScanHigh 7.5
When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookup_WP_account.
Fixed in
1.4.1
What to do
Update the plugin to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings.CVE-2021-24162 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.
Fixed in
4.0.4
What to do
Update the plugin to 4.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive conCVE-2021-24161 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site.
Fixed in
4.0.4
What to do
Update the plugin to 4.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality.CVE-2021-24158 · WordPress plugins & themes · reported by WPScanMedium 6.5
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for lower-level users, however, they can still supply the user_role parameter to update the default role for registration.
Fixed in
2.10.3
What to do
Update the plugin to 2.10.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML wiCVE-2021-24156 · WordPress plugins & themes · reported by WPScanMedium 5.4
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation
Affected
3.0.3 to 3.0.3
What to do
Affects 3.0.3 to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mega.nz wpscan.com
Apr 5, 2021Theme Editor: Did not validate the GET file parameter before passing it to the download_file() functionCVE-2021-24154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd
Product
Theme Editor
Fixed in
2.6
What to do
Update Theme Editor to 2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blackCVE-2021-24153 · WordPress plugins & themes · reported by WPScanMedium 5.4
A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.
Product
Yoast SEO
Fixed in
3.4.1
What to do
Update Yoast SEO to 3.4.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Mar 18, 2021A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated CVE-2021-24148 · WordPress plugins & themes · reported by WPScanCritical 9.8
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
Product
MStore API
Fixed in
3.2.0
What to do
Update MStore API to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vCVE-2021-24135 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.
Product
WP Customer Reviews
Fixed in
3.4.3
What to do
Update WP Customer Reviews to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site ScriptinCVE-2021-24134 · WordPress plugins & themes · reported by WPScanMedium 4.8
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
Product
Constant Contact Forms
Fixed in
1.8.8
What to do
Update Constant Contact Forms to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vCVE-2021-24129 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.
Product
Themify Portfolio Post
Fixed in
1.1.6
What to do
Update Themify Portfolio Post to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.