Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
123 results · page 2 of 3
Apr 9, 2025WordPress Spam Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32581 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ankit Singla WordPress Spam Blocker cf7-manual-spam-blocker allows Stored XSS.This issue affects WordPress Spam Blocker: from n/a through <= 2.0.5.
- Product
- WordPress Spam Blocker
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update WordPress Spam Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025AlphaOmega Captcha & Anti-Spam Filter: Cross-Site Request Forgery (CSRF)CVE-2025-30584 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through <= 3.3.
- Product
- AlphaOmega Captcha & Anti-Spam Filter
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update AlphaOmega Captcha & Anti-Spam Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Spam Byebye: Cross-Site Request Forgery (CSRF)CVE-2025-28941 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ohtan Spam Byebye spam-byebye allows Cross Site Request Forgery.This issue affects Spam Byebye: from n/a through <= 2.2.4.
- Product
- Spam Byebye
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Spam Byebye to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Block Spam By Math Reloaded: Missing AuthorizationCVE-2025-28872 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.
- Product
- Block Spam By Math Reloaded
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Block Spam By Math Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Block Spam By Math Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28871 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.
- Product
- Block Spam By Math Reloaded
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Block Spam By Math Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 25, 2025WP Contact Form7 Email Spam Blocker: Reflected Cross-Site ScriptingCVE-2024-13467 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Contact Form7 Email Spam Blocker
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Contact Form7 Email Spam Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 16, 2025Contact Form 7 Anti Spambot: Missing AuthorizationCVE-2025-23862 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SzMake Contact Form 7 Anti Spambot contact-form-7-anti-spambot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 Anti Spambot: from n/a through <= 1.0.1.
- Product
- Contact Form 7 Anti Spambot
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Contact Form 7 Anti Spambot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Stop Comment Spam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23826 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pedjas Stop Comment Spam stop-comment-spam allows Stored XSS.This issue affects Stop Comment Spam: from n/a through <= 0.5.3.
- Product
- Stop Comment Spam
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update Stop Comment Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Peter’s Custom Anti-Spam: Cross-Site Request ForgeryCVE-2024-12554 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Peter’s Custom Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing nonce validation on the cas_register_post() function. This makes it possible for unauthenticated attackers to blacklist emails via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Peter’s Custom Anti-Spam
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Peter’s Custom Anti-Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 17, 2024Stop Registration Spam: Cross-Site Request ForgeryCVE-2024-12219 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Stop Registration Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-56017 is likely a duplicate of this issue.
- Product
- Stop Registration Spam
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update Stop Registration Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 16, 2024Stop Registration Spam: Cross-Site Request Forgery (CSRF)CVE-2024-56017 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a through 1.23.
- Product
- Stop Registration Spam
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update Stop Registration Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Spam protection, AntiSpam, FireWall by CleanTalk: Missing AuthorizationCVE-2023-33996 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spam protection, AntiSpam, FireWall by CleanTalk: from n/a through 6.10.
- Product
- Spam protection, AntiSpam, FireWall by CleanTalk
- Affected
- up to 6.10
- What to do
- Affects up to 6.10. Update Spam protection, AntiSpam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Reflected Cross-Site ScriptingCVE-2024-11436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Affected
- up to 1.4.19
- What to do
- Affects up to 1.4.19. Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024Maspik – Spam blacklist: Missing AuthorizationCVE-2024-53806 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in yonifre Maspik – Spam blacklist contact-forms-anti-spam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Maspik – Spam blacklist: from n/a through <= 2.2.7.
- Product
- Maspik – Spam blacklist
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Maspik – Spam blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 26, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2024-10781 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
- Product
- Spam protection, Anti-Spam, FireWall by CleanTalk
- Affected
- up to 6.44
- What to do
- Affects up to 6.44. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 26, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2024-10542 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
- Product
- Spam protection, Anti-Spam, FireWall by CleanTalk
- Affected
- up to 6.43.2
- What to do
- Affects up to 6.43.2. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2024NIX Anti-Spam Light: Deserialization of Untrusted DataCVE-2024-52432 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Object Injection.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.
- Product
- NIX Anti-Spam Light
- Affected
- up to 0.0.4
- What to do
- Affects up to 0.0.4. Update NIX Anti-Spam Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Titan Anti-spam & Security: Missing AuthorizationCVE-2024-38777 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CreativeMotion Titan Anti-spam & Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Titan Anti-spam & Security: from n/a through 7.3.6.
- Product
- Titan Anti-spam & Security
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update Titan Anti-spam & Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2024Kama SpamBlock: Reflected Cross-Site ScriptingCVE-2024-9647 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Kama SpamBlock plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST values in all versions up to, and including, 1.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Kama SpamBlock
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update Kama SpamBlock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 8, 2024Limit Login Attempts (Spam Protection): IP Address SpoofingCVE-2022-4534 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.
- Product
- Limit Login Attempts (Spam Protection)
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update Limit Login Attempts (Spam Protection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 4, 2024Maspik – Spam blacklist: Authentication Bypass by SpoofingCVE-2023-48271 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in yonifre Maspik – Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maspik – Spam blacklist: from n/a through 0.10.3.
- Product
- Maspik – Spam blacklist
- Affected
- up to 0.10.3
- What to do
- Affects up to 0.10.3. Update Maspik – Spam blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Antispam Bee: Authentication Bypass by SpoofingCVE-2023-41134 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Antispam Bee: from n/a through 2.11.3.
- Product
- Antispam Bee
- Affected
- up to 2.11.3
- What to do
- Affects up to 2.11.3. Update Antispam Bee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 30, 2024Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Unauthorized access of dataCVE-2024-4355 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the stopbadbots_get_ajax_data() function in all versions up to, and including, 10.23. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose visitor data.
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Affected
- up to 10.23
- What to do
- Affects up to 10.23. Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 17, 2024Zero Spam: Client-Side Enforcement of Server-Side SecurityCVE-2024-32521 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zero Spam: from n/a through 5.5.6.
- Product
- Zero Spam
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update Zero Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 4, 2024Stop Spammers Security | Block Spam Users, Comments, Forms: Cross-Site Request ForgeryCVE-2023-7065 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfs_process AJAX action. This makes it possible for unauthenticated attackers to add arbitrary IPs to the plugin's allowlist and blocklist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Affected
- up to 2024.4
- What to do
- Affects up to 2024.4. Update Stop Spammers Security | Block Spam Users, Comments, Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 10, 2024User Spam Remover: Insertion of Sensitive Information into Log FileCVE-2024-31298 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0.
- Product
- User Spam Remover
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update User Spam Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 19, 2024WP Armour – Honeypot Anti Spam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29091 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dnesscarkey WP Armour – Honeypot Anti Spam allows Reflected XSS.This issue affects WP Armour – Honeypot Anti Spam: from n/a through 2.1.13.
- Product
- WP Armour – Honeypot Anti Spam
- Affected
- up to 2.1.13
- What to do
- Affects up to 2.1.13. Update WP Armour – Honeypot Anti Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 17, 2024AntiSpam for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27961 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codekraft AntiSpam for Contact Form 7 allows Reflected XSS.This issue affects AntiSpam for Contact Form 7: from n/a through 0.6.0.
- Product
- AntiSpam for Contact Form 7
- Affected
- up to 0.6.0
- What to do
- Affects up to 0.6.0. Update AntiSpam for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2024Maspik – Spam Blacklist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25101 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik – Spam Blacklist allows Stored XSS.This issue affects Maspik – Spam Blacklist: from n/a through 0.10.6.
- Product
- Maspik – Spam Blacklist
- Affected
- up to 0.10.6
- What to do
- Affects up to 0.10.6. Update Maspik – Spam Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 29, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Cross-Site Request Forgery (CSRF)CVE-2023-51696 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20.
- Product
- Spam protection, Anti-Spam, FireWall by CleanTalk
- Affected
- up to 6.20
- What to do
- Affects up to 6.20. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 5, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Cross-Site Request Forgery (CSRF)CVE-2023-51535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20.
- Product
- Spam protection, Anti-Spam, FireWall by CleanTalk
- Affected
- up to 6.20
- What to do
- Affects up to 6.20. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Maspik – Spam Blacklist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48272 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik – Spam Blacklist allows Stored XSS.This issue affects Maspik – Spam Blacklist: from n/a through 0.9.2.
- Product
- Maspik – Spam Blacklist
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Maspik – Spam Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Wielogórski Stop Referrer Spam plugin <= 1.3.0 versions.CVE-2023-33207 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Wielogórski Stop Referrer Spam plugin <= 1.3.0 versions.
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.CVE-2023-34371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.
- Affected
- up to 2.22
- What to do
- Affects up to 2.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 3, 2023Zero Spam for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32121 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injection.This issue affects Zero Spam for WordPress: from n/a through 5.4.4.
- Product
- Zero Spam for
- Affected
- up to 5.4.4
- What to do
- Affects up to 5.4.4. Update Zero Spam for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.44 versions.CVE-2023-35913 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.44 versions.
- Fixed in
- 1.1.45
- What to do
- Update the plugin to 1.1.45 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in yonifre Maspik – Spam Blacklist plugin <= 0.7.8 versions.CVE-2023-24008 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in yonifre Maspik – Spam Blacklist plugin <= 0.7.8 versions.
- Affected
- up to 0.7.8
- What to do
- Affects up to 0.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 6, 2023A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress.CVE-2015-10093 · WordPress plugins & themes · reported by VulDBLow 2.6
A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is e7059727274d2767c240c55c02c163eaa4ba6c62. It is recommended to upgrade the affected component. The identifier VDB-222325 was assigned to this vulnerability.
- What to do
- Update the plugin to the newest version.
Jan 2, 2023WP Cerber Security, Anti-spam & Malware Scan: Does not properly block access to the REST API users endpointCVE-2022-4417 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 9.3.3
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 9.3.3 or newer.
Dec 26, 2022Stop Spammers Security | Block Spam Users, Comments, Forms: Passes base64 encoded user input to the unserialize() PHP functionCVE-2022-4120 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2022.6
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2022.6 or newer.
Dec 12, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3883 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 7.24
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 7.24 or newer.
Oct 25, 2022Spam protection, AntiSpam, FireWall by CleanTalk: Does not validate ids before using them in a SQL statementCVE-2022-3302 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statement, which could lead to SQL injection exploitable by high privilege users such as admin
- Product
- Spam protection, AntiSpam, FireWall by CleanTalk
- Fixed in
- 5.185.1
- What to do
- Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.185.1 or newer.
Sep 16, 2022Titan Anti-spam & Security: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-2877 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- Titan Anti-spam & Security
- Fixed in
- 7.3.1
- What to do
- Update Titan Anti-spam & Security to 7.3.1 or newer.
Aug 29, 2022Stop Spam Comments: Does not properly generate the Javascript access token for preventing abuse of comment sectionCVE-2022-1663 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
- Product
- Stop Spam Comments
- Affected
- up to 0.2.1.2
- What to do
- Affects up to 0.2.1.2. Update Stop Spam Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Throws SPAM Away: Does not have CSRF checks in placeCVE-2022-1709 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers to make a logged in admin delete comments via a CSRF attack
- Product
- Throws SPAM Away
- Fixed in
- 3.3.1
- What to do
- Update Throws SPAM Away to 3.3.1 or newer.
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
Apr 19, 2022CleanTalk AntiSpam plugin <= 5.173: Reflected Cross-Site Scripting (XSS)CVE-2022-28222 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter in`/lib/Cleantalk/ApbctWP/FindSpam/ListTable/Users.php`
- Product
- CleanTalk AntiSpam plugin <= 5.173
- Affected
- up to 5.173
- What to do
- Affects up to 5.173. Update CleanTalk AntiSpam plugin <= 5.173 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Apr 19, 2022CleanTalk AntiSpam plugin <= 5.173: Reflected Cross-Site Scripting (XSS)CVE-2022-28221 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter in`/lib/Cleantalk/ApbctWP/FindSpam/ListTable/Comments.php`
- Product
- CleanTalk AntiSpam plugin <= 5.173
- Affected
- up to 5.173
- What to do
- Affects up to 5.173. Update CleanTalk AntiSpam plugin <= 5.173 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.