Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

439new WordPress flaws this week

394,398entries in the database

8,988 results · page 177 of 180

Apr 11, 2022Easy Social Icons: Does not properly escape the image_file fieldCVE-2022-0840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
Product
Easy Social Icons
Fixed in
3.2.1
What to do
Update Easy Social Icons to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Favicon by RealFaviconGenerator: Does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboardCVE-2022-0471 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Favicon by RealFaviconGenerator
Fixed in
1.3.23
What to do
Update Favicon by RealFaviconGenerator to 1.3.23 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022Amelia: Does not have proper authorisationCVE-2022-0837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerability to drain out the account balance by keep sending SMS notification.
Product
Amelia
Fixed in
1.0.48
What to do
Update Amelia to 1.0.48 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022Amelia: Does not have proper authorisationCVE-2022-0825 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Product
Amelia
Fixed in
1.0.49
What to do
Update Amelia to 1.0.49 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 28, 2022Amelia: Does not have proper authorisationCVE-2022-0720 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Product
Amelia
Fixed in
1.0.47
What to do
Update Amelia to 1.0.47 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022String locator: Does not properly validate the path of the files to be searchedCVE-2022-0493 · WordPress plugins & themes · reported by WPScanMedium 4.9
The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be provided, which will be used to output the relevant matches from the matching file, all content of the file can be disclosed.
Product
String locator
Fixed in
2.5.0
What to do
Update String locator to 2.5.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 28, 2022Block Bad Bots: Does not properly sanitise and escape the User Agent before using it in a SQL statement to record logsCVE-2021-25070 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue
Product
Block Bad Bots
Fixed in
6.88
What to do
Update Block Bad Bots to 6.88 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Product
BookingPress
Fixed in
1.0.11
What to do
Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022miniOrange's Google Authenticator: Does not have proper authorisation and CSRF checksCVE-2022-0229 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
Product
miniOrange's Google Authenticator
Fixed in
5.5
What to do
Update miniOrange's Google Authenticator to 5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Product
WordPress Zero Spam
Fixed in
5.2.11
What to do
Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2022HTML5 Responsive FAQ: Does not properly sanitise and escape some of its settingsCVE-2021-24995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
HTML5 Responsive FAQ
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update HTML5 Responsive FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022Maps Plugin using Google Maps for: Does not have proper authorisation and CSRF in most of its AJAX actionsCVE-2021-25011 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings.
Product
Maps Plugin using Google Maps for
Fixed in
1.8.1
What to do
Update Maps Plugin using Google Maps for to 1.8.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
Product
Database Backup for
Fixed in
2.5.1
What to do
Update Database Backup for to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Product
Popup Builder
Fixed in
4.0.7
What to do
Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 17, 2022The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nCVE-2022-0633 · WordPress plugins & themes · reported by WPScanMedium 6.5
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
Fixed in
1.22.3
What to do
Update the plugin to 1.22.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com jetpack.com
Feb 14, 2022NewStatPress: Does not properly escape the whatX parameters before outputting them back in attributesCVE-2022-0206 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
NewStatPress
Fixed in
1.3.6
What to do
Update NewStatPress to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Remove Footer Credit: Does properly sanitise its settingsCVE-2021-25050 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
Remove Footer Credit
Fixed in
1.0.11
What to do
Update Remove Footer Credit to 1.0.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022RVM: Does not have proper authorisationCVE-2021-24947 · WordPress plugins & themes · reported by WPScanMedium 6.5
The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server
Product
RVM
Fixed in
6.4.2
What to do
Update RVM to 6.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Rearrange Woocommerce Products: Does not have proper access controls in the save_all_order AJAX actionCVE-2021-24928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.
Product
Rearrange Woocommerce Products
Fixed in
3.0.8
What to do
Update Rearrange Woocommerce Products to 3.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022LabTools: Does not have proper authorisation and CSRF check in placeCVE-2021-25097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
Product
LabTools
Affected
up to 1.0
What to do
Affects up to 1.0. Update LabTools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Perfect Survey: Does not have proper authorisation nor CSRF checks in the save_global_setting AJAX actionCVE-2021-24763 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey
Product
Perfect Survey
Fixed in
1.5.2
What to do
Update Perfect Survey to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022EventCalendar: Does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actionsCVE-2021-25025 · WordPress plugins & themes · reported by WPScanMedium 4.3
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
Product
EventCalendar
Fixed in
1.1.51
What to do
Update EventCalendar to 1.1.51 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022LiteSpeed Cache: Does not properly verify that requests are coming from QUICCVE-2021-24964 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
Product
LiteSpeed Cache
Fixed in
4.4.4
What to do
Update LiteSpeed Cache to 4.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Download Monitor: Does not properly validate and escape the "orderby" GET parameter before using it in a SQL statementCVE-2021-24786 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
Product
Download Monitor
Fixed in
4.4.5
What to do
Update Download Monitor to 4.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
Product
Tickera
Fixed in
3.4.8.3
What to do
Update Tickera to 3.4.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Rich Reviews by Starfish: Does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statementCVE-2021-24753 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
Product
Rich Reviews by Starfish
Fixed in
1.9.6
What to do
Update Rich Reviews by Starfish to 1.9.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 21, 2021The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not propeCVE-2021-24849 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
Product
WCFM Marketplace
Fixed in
3.4.12
What to do
Update WCFM Marketplace to 3.4.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021WP Visitor Statistics (Real Time Traffic): Does not properly sanitise and escape the refUrl in the refDetails AJAX actionCVE-2021-24750 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
4.8
What to do
Update WP Visitor Statistics (Real Time Traffic) to 4.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Dec 13, 2021Page/Post Content Shortcode: Does not have proper authorisation in placeCVE-2021-24819 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors.
Product
Page/Post Content Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Page/Post Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WP Data Access: Does not properly sanitise and escape the backup_date parameter before using it a SQL statementCVE-2021-24866 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion
Product
WP Data Access
Fixed in
5.0.0
What to do
Update WP Data Access to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021Contact Form, Survey & Popup Form Plugin for: Does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-24718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Contact Form, Survey & Popup Form Plugin for
Fixed in
1.5
What to do
Update Contact Form, Survey & Popup Form Plugin for to 1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021WP RSS Aggregator: Does not properly sanitise and escape the URL to Blacklist fieldCVE-2021-24768 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
Product
WP RSS Aggregator
Fixed in
4.19.2
What to do
Update WP RSS Aggregator to 4.19.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Email Before Download: Does not properly validate and escape the order and orderby GET parameters before using them in SQL statementsCVE-2021-24748 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
Product
Email Before Download
Fixed in
6.8
What to do
Update Email Before Download to 6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
Product
My Tickets
Fixed in
1.8.31
What to do
Update My Tickets to 1.8.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021Email Log: Does not properly validateCVE-2021-24758 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections
Product
Email Log
Fixed in
2.4.7
What to do
Update Email Log to 2.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Post Expirator: Does not have proper capability checks in placeCVE-2021-24783 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.
Product
Post Expirator
Fixed in
2.6.0
What to do
Update Post Expirator to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpCVE-2021-24731 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
Product
Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
Fixed in
3.7.1.6
What to do
Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.7.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Qwizcards – online quizzes and flashcards: Does not properly sanitize and escape some of its settingsCVE-2021-24706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Qwizcards – online quizzes and flashcards
Fixed in
3.62
What to do
Update Qwizcards – online quizzes and flashcards to 3.62 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Booking.com Banner Creator: Does not properly sanitize inputsCVE-2021-24646 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Booking.com Banner Creator
Fixed in
1.4.3
What to do
Update Booking.com Banner Creator to 1.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021School Management System – WPSchoolPress: Does not properly sanitize or use prepared statements before using POST variable in SQL queriesCVE-2021-24575 · WordPress plugins & themes · reported by WPScanHigh 8.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.
Product
School Management System – WPSchoolPress
Fixed in
2.1.10
What to do
Update School Management System – WPSchoolPress to 2.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WP Reactions Lite: Does not properly sanitize inputs within wp-admin pagesCVE-2021-24723 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages.
Product
WP Reactions Lite
Fixed in
1.3.6
What to do
Update WP Reactions Lite to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Restaurant Menu by MotoPress: Does not properly sanitize or escape inputsCVE-2021-24722 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Restaurant Menu by MotoPress
Fixed in
2.4.2
What to do
Update Restaurant Menu by MotoPress to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
Product
Modern Events Calendar Lite
Fixed in
5.22.3
What to do
Update Modern Events Calendar Lite to 5.22.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WP Sitemap Page: Does not properly sanitise and escape some of its settingsCVE-2021-24715 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WP Sitemap Page
Fixed in
1.7.0
What to do
Update WP Sitemap Page to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021MP3 Audio Player for Music, Radio & Podcast by Sonaar: Does not properly sanitize or escape data in some of its Playlist settingsCVE-2021-24624 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Fixed in
2.4.2
What to do
Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WP Attachment Export: Does not have proper access controlsCVE-2015-20067 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
Product
WP Attachment Export
Fixed in
0.2.4
What to do
Update WP Attachment Export to 0.2.4 or newer.
Full record and what to do →NVD record github.com seclists.org
Oct 25, 2021Cookie Bar: Doesn't properly sanitise the Cookie Bar Message settingCVE-2021-24653 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Cookie Bar
Fixed in
1.8.9
What to do
Update Cookie Bar to 1.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
Product
LearnPress
Fixed in
4.1.3.1
What to do
Update LearnPress to 4.1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Comments – wpDiscuz: Does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the pageCVE-2021-24737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Comments – wpDiscuz
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Appointment Hour Booking: Does not properly sanitize values usedCVE-2021-24712 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars.
Product
Appointment Hour Booking
Fixed in
1.3.17
What to do
Update Appointment Hour Booking to 1.3.17 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.