Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

277new WordPress flaws this week

393,915entries in the database

10,183 results · page 196 of 204

Dec 20, 2021Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versCVE-2021-36889 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
Affected
up to 1.6
What to do
Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 15, 2021Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPreCVE-2021-36888 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
Affected
up to 9.6.1
What to do
Affects up to 9.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 14, 2021The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid useCVE-2021-4073 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.
Affected
up to 5.0.1.7
What to do
Affects up to 5.0.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-SiCVE-2021-42549 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.15.3
What to do
Update search functionality of to 1.15.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected CCVE-2021-42548 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.15.3
What to do
Update search functionality of to 1.15.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected CrCVE-2021-42547 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.20.3
What to do
Update search functionality of to 1.20.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected CrCVE-2021-42546 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.18.3
What to do
Update search functionality of to 1.18.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Like Button Rating ♥ LikeBtn: Does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX actionCVE-2021-24945 · WordPress plugins & themes · reported by WPScanHigh 8
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.
Product
Like Button Rating ♥ LikeBtn
Fixed in
2.6.38
What to do
Update Like Button Rating ♥ LikeBtn to 2.6.38 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
Modern Events Calendar Lite
Fixed in
6.1.5
What to do
Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categorCVE-2021-24848 · WordPress plugins & themes · reported by WPScanHigh 8.8
The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection
Product
Mediamatic
Fixed in
2.8.1
What to do
Update Mediamatic to 2.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Temporary Login Without Password: Does not have authorisation and CSRF checksCVE-2021-24836 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
Product
Temporary Login Without Password
Fixed in
1.7.1
What to do
Update Temporary Login Without Password to 1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Page/Post Content Shortcode: Does not have proper authorisation in placeCVE-2021-24819 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors.
Product
Page/Post Content Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Page/Post Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Shiny Buttons: Does not have any authorisation and CSRF in placeCVE-2021-24792 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.
Product
Shiny Buttons
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Shiny Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Contact Form Advanced Database: Does not have any authorisationCVE-2021-24790 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.
Product
Contact Form Advanced Database
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Contact Form Advanced Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021SEO Booster: Allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX requestCVE-2021-24747 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections.
Product
SEO Booster
Fixed in
3.8
What to do
Update SEO Booster to 3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021moving the field group which may allow a user to move the unauthorized field group: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20867 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
Product
moving the field group which may allow a user to move the unauthorized field group
What to do
Update moving the field group which may allow a user to move the unauthorized field group to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 13, 2021obtaining the user list which may allow a user to obtain the unauthorized information: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20866 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
Product
obtaining the user list which may allow a user to obtain the unauthorized information
What to do
Update obtaining the user list which may allow a user to obtain the unauthorized information to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 13, 2021browsing database which may allow a user to browse unauthorized data: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20865 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
Product
browsing database which may allow a user to browse unauthorized data
What to do
Update browsing database which may allow a user to browse unauthorized data to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 6, 2021Registrations for the Events Calendar: Does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2021-24943 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
Product
Registrations for the Events Calendar
Fixed in
2.7.6
What to do
Update Registrations for the Events Calendar to 2.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WOOCS: Does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24938 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue
Product
WOOCS
Fixed in
1.3.7.1
What to do
Update WOOCS to 1.3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WP Google Fonts: Does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributesCVE-2021-24935 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues
Product
WP Google Fonts
Fixed in
3.1.5
What to do
Update WP Google Fonts to 3.1.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021Secure Copy Content Protection and Content Locking: Does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SCVE-2021-24931 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.
Product
Secure Copy Content Protection and Content Locking
Fixed in
2.8.2
What to do
Update Secure Copy Content Protection and Content Locking to 2.8.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Nov 29, 2021My Calendar: Does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24927 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
My Calendar
Fixed in
3.2.18
What to do
Update My Calendar to 3.2.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Stylish Cost Calculator: Does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users)CVE-2021-24822 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters
Product
Stylish Cost Calculator
Fixed in
7.0.4
What to do
Update Stylish Cost Calculator to 7.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021About Author Box: Does not sanitise and escape the Social Profiles field values before outputting them in attributesCVE-2021-24745 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
About Author Box
Fixed in
1.0.2
What to do
Update About Author Box to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 26, 2021Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id,CVE-2021-36919 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 26, 2021Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media ConfiguCVE-2021-36843 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
Affected
up to 4.3.5
What to do
Affects up to 4.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 24, 2021WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user.CVE-2021-36917 · WordPress plugins & themes · reported by PatchstackMedium 6.5
WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.
Affected
up to 6.2.3
What to do
Affects up to 6.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net patchstack.com
Nov 23, 2021Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's emCVE-2021-24892 · WordPress plugins & themes · reported by WPScanHigh 8.8
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
Fixed in
1.6.9
What to do
Update the plugin to 1.6.9 or newer.
Full record and what to do →NVD record github.com wpscan.com
Nov 19, 2021Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.CVE-2021-36884 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2021WordPress WP Reset PRO Premium: Authenticated Database ResetCVE-2021-36909 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.
Product
WordPress WP Reset PRO Premium
Affected
up to 5.98
What to do
Affects up to 5.98. Update WordPress WP Reset PRO Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2021The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, doeCVE-2021-24847 · WordPress plugins & themes · reported by WPScanHigh 8.8
The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed
Product
SEO Redirection Plugin – 301 Redirect Manager
Fixed in
8.2
What to do
Update SEO Redirection Plugin – 301 Redirect Manager to 8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Squaretype: Allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpointCVE-2021-24840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request.
Product
Squaretype
Fixed in
3.0.4
What to do
Update Squaretype to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Visitor Traffic Real Time Statistics: Does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statementCVE-2021-24829 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue
Product
Visitor Traffic Real Time Statistics
Fixed in
3.9
What to do
Update Visitor Traffic Real Time Statistics to 3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Support Board: Allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes fieldCVE-2021-24807 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
Product
Support Board
Fixed in
3.3.5
What to do
Update Support Board to 3.3.5 or newer.
Full record and what to do →NVD record github.com medium.com
Nov 8, 2021WP Survey Plus: Does not have any authorisation and CSRF checks in place in its AJAX actionsCVE-2021-24801 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues
Product
WP Survey Plus
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Survey Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 5, 2021WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenCVE-2021-42359 · WordPress plugins & themes · reported by WordfenceHigh 7.5
WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.
Affected
up to 3.1.23
What to do
Affects up to 3.1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Nov 1, 2021OptinMonster: Sensitive information disclosure and unauthorized setting updatesCVE-2021-39341 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.
Product
OptinMonster
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2021Stylish Price List: Does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users)CVE-2021-24770 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users), which could allow any authenticated users, such as subscriber, to upload arbitrary images.
Product
Stylish Price List
Fixed in
6.9.1
What to do
Update Stylish Price List to 6.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Stylish Price List: Does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users)CVE-2021-24757 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.
Product
Stylish Price List
Fixed in
6.9.0
What to do
Update Stylish Price List to 6.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Logo Slider and Showcase: Allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability checkCVE-2021-24742 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.
Product
Logo Slider and Showcase
Fixed in
1.3.37
What to do
Update Logo Slider and Showcase to 1.3.37 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021LearnDash LMS: Does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() functionCVE-2018-25019 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server
Product
LearnDash LMS
Fixed in
2.5.4
What to do
Update LearnDash LMS to 2.5.4 or newer.
Full record and what to do →NVD record lists.openwall.net wpscan.com
Oct 25, 2021Great Quotes: Does not sanitise and escape the Quote and Author fields of its QuotesCVE-2021-24785 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
Great Quotes
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Great Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021WP Debugging: Has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checksCVE-2021-24779 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.
Product
WP Debugging
Fixed in
2.11.0
What to do
Update WP Debugging to 2.11.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users,CVE-2021-24752 · WordPress plugins & themes · reported by WPScanMedium 5.7
Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.
Product
ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets
Fixed in
1.9
What to do
Update ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets to 1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021WordPress PDF Light Viewer: Allows users with Author roles to execute arbitrary OS command on the server via OS Command InjectionCVE-2021-24684 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.
Product
WordPress PDF Light Viewer
Fixed in
1.4.12
What to do
Update WordPress PDF Light Viewer to 1.4.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Find My Blocks: Does not have authorisation checks in its REST APICVE-2021-24677 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.
Product
Find My Blocks
Fixed in
3.4.0
What to do
Update Find My Blocks to 3.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 15, 2021Author Bio Box: Stored Cross-Site ScriptingCVE-2021-39349 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Author Bio Box
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Author Bio Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_creatCVE-2021-38346 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory traversal, and the file contents were populated via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin added a .jpg extension to all uploaded filenames, a double extension attack was still possible, e.g. a file named shell.php would be saved as shell.php.jpg, and would be executable on a number of common configurations.
Product
Brizy Page Builder
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update Brizy Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admCVE-2021-38345 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127.
Product
Brizy Page Builder
Affected
up to 2.3.11
Fixed in
1.0.126
What to do
Update Brizy Page Builder to 1.0.126 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.