Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
95 results · page 2 of 2
Jan 21, 2025Social Share, Social Login and Social Comments Plugin – Super Socializer: Limited SQL InjectionCVE-2024-13230 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional values into the already existing query that can be used to extract user metadata from the database.
- Product
- Social Share, Social Login and Social Comments Plugin – Super Socializer
- Affected
- up to 7.14
- What to do
- Affects up to 7.14. Update Social Share, Social Login and Social Comments Plugin – Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025MindValley Super PageMash: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22502 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mindvalley MindValley Super PageMash mindvalley-pagemash allows SQL Injection.This issue affects MindValley Super PageMash: from n/a through <= 1.1.
- Product
- MindValley Super PageMash
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MindValley Super PageMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP SuperBackup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Reflected XSS.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56070 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Deserialization of Untrusted DataCVE-2024-56068 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56067 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Unrestricted Upload of File with Dangerous TypeCVE-2024-56064 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Super Socializer: Missing AuthorizationCVE-2023-41802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Team Heateor Super Socializer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Socializer: from n/a through 7.13.54.
- Product
- Super Socializer
- Affected
- up to 7.13.54
- What to do
- Affects up to 7.13.54. Update Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Super Backup & Clone - Migrate for: Arbitrary file uploadsCVE-2024-9290 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Super Backup & Clone - Migrate for
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Super Backup & Clone - Migrate for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Dec 9, 2024Super Progressive Web Apps: Missing AuthorizationCVE-2023-48277 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SuperPWA Super Progressive Web Apps super-progressive-web-apps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Progressive Web Apps: from n/a through <= 2.2.21.
- Product
- Super Progressive Web Apps
- Affected
- up to 2.2.21
- What to do
- Affects up to 2.2.21. Update Super Progressive Web Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Super Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51588 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in riponhossain Super Addons for Elementor super-addons-for-elementor allows DOM-Based XSS.This issue affects Super Addons for Elementor: from n/a through <= 1.0.
- Product
- Super Addons for Elementor
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Super Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2024Social Share, Social Login and Social Comments Plugin – Super Socializer: Authentication bypassCVE-2024-9946 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they have access to the email and the user does not have an already-existing account for the service returning the token. An attacker cannot authenticate as an administrator by default, but these accounts are also at risk if authentication for administrators has explicitly been allowed via the social login. The vulnerability was partially patched in version 7.13.68.
- Product
- Social Share, Social Login and Social Comments Plugin – Super Socializer
- Affected
- up to 7.13.68
- What to do
- Affects up to 7.13.68. Update Social Share, Social Login and Social Comments Plugin – Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2024Super Testimonials: Stored Cross-Site ScriptingCVE-2024-9127 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Super Testimonials
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2024Super Store Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43975 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through <= 6.9.7.
- Product
- Super Store Finder
- Affected
- up to 6.9.7
- What to do
- Affects up to 6.9.7. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Super Store Finder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43978 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through < 6.9.8.
- Product
- Super Store Finder
- Fixed in
- 6.9.8
- What to do
- Update Super Store Finder to 6.9.8 or newer.
Sep 17, 2024Super Store Finder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43976 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through <= 6.9.7.
- Product
- Super Store Finder
- Affected
- up to 6.9.7
- What to do
- Affects up to 6.9.7. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024The Affiliate Super Assistent: Arbitrary shortcode executionCVE-2024-8478 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Affiliate Super Assistent
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update The Affiliate Super Assistent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 2, 2024WordPress Menu Plugin — Superfly Responsive Menu: Cross-Site Request ForgeryCVE-2024-3238 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Menu Plugin — Superfly Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.29. This is due to missing or incorrect nonce validation on the ajax_handle_delete_icons() function. This makes it possible for unauthenticated attackers to delete arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please not the CSRF was patched in 5.0.28, however, adequate directory traversal protection wasn't introduced until 5.0.30.
- Product
- WordPress Menu Plugin — Superfly Responsive Menu
- Affected
- up to 5.0.29
- What to do
- Affects up to 5.0.29. Update WordPress Menu Plugin — Superfly Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 21, 2024SuperSaaS – online appointment scheduling: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37460 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SuperSaaS SuperSaaS – online appointment scheduling allows Stored XSS.This issue affects SuperSaaS – online appointment scheduling: from n/a through 2.1.9.
- Product
- SuperSaaS – online appointment scheduling
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update SuperSaaS – online appointment scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024SuperFaktura WooCommerce: Server-Side Request Forgery (SSRF)CVE-2024-32803 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in 2day.Sk, Webikon SuperFaktura WooCommerce.This issue affects SuperFaktura WooCommerce: from n/a through 1.40.3.
- Product
- SuperFaktura WooCommerce
- Affected
- up to 1.40.3
- What to do
- Affects up to 1.40.3. Update SuperFaktura WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 18, 2024Superfly Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in looks_awesome Superfly Menu superfly-menu.This issue affects Superfly Menu: from n/a through <= 5.0.25.
- Product
- Superfly Menu
- Affected
- up to 5.0.25
- What to do
- Affects up to 5.0.25. Update Superfly Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 6, 2024Powerkit – Supercharge your WordPress Site: Stored Cross-Site ScriptingCVE-2024-2458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit – Supercharge your WordPress Site
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Powerkit – Supercharge your WordPress Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 21, 2024Super Page Cache for Cloudflare: Cross-Site Request Forgery (CSRF)CVE-2024-27968 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.This issue affects Super Page Cache for Cloudflare: from n/a through 4.7.5.
- Product
- Super Page Cache for Cloudflare
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update Super Page Cache for Cloudflare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 26, 2024SuperFaktura WooCommerce: Server-Side Request ForgeryCVE-2024-1758 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 via the wc_sf_url_check function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. CVE-2024-32803 appears to be a duplicate of this issue.
- Product
- SuperFaktura WooCommerce
- Affected
- up to 1.40.3
- What to do
- Affects up to 1.40.3. Update SuperFaktura WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2024Super Forms - Drag & Drop Form Builder: Does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX actionCVE-2022-0402 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX action, leading to a Reflected Cross-Site Scripting. The action is also lacking CSRF, making the attack easier to perform against any user.
- Product
- Super Forms - Drag & Drop Form Builder
- Fixed in
- 6.0.4
- What to do
- Update Super Forms - Drag & Drop Form Builder to 6.0.4 or newer.
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Timo Reith Affiliate Super Assistent plugin <= 1.5.1 versions.CVE-2023-27417 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Timo Reith Affiliate Super Assistent plugin <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.CVE-2023-29428 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 31, 2023Superb slideshow gallery: SQL InjectionCVE-2023-5434 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Superb slideshow gallery
- Affected
- up to 13.1
- What to do
- Affects up to 13.1. Update Superb slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023Super Testimonials: Stored Cross-Site ScriptingCVE-2023-5613 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Super Testimonials
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2023Super Store Finder: Unauthenticated arbitrary email creation and relayCVE-2023-5054 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer.
- Product
- Super Store Finder
- Affected
- up to 6.9.3
- What to do
- Affects up to 6.9.3. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsuperstorefinder.netsuperstorefinder.net
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.CVE-2023-22678 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 21, 2023The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed CVE-2023-0453 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.
- Fixed in
- 1.0.6
- What to do
- Update the plugin to 1.0.6 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Jan 2, 2023The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site ScripCVE-2022-4114 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks.
- Fixed in
- 1.2.33
- What to do
- Update the plugin to 1.2.33 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Nov 14, 2022Testimonials WordPress plugin before 2.7, super-testimonial-pro: Do not sanitize and escape its settingsCVE-2022-3539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Testimonials WordPress plugin before 2.7, super-testimonial-pro
- Fixed in
- 2.7
- What to do
- Update Testimonials WordPress plugin before 2.7, super-testimonial-pro to 2.7 or newer.
May 2, 2022SiteSuperCharger: Does not validateCVE-2022-0771 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SiteSuperCharger WordPress plugin before 5.2.0 does not validate, sanitise and escape various user inputs before using them in SQL statements via AJAX actions (available to both unauthenticated and authenticated users), leading to Unauthenticated SQL Injections
- Product
- SiteSuperCharger
- Fixed in
- 5.2.0
- What to do
- Update SiteSuperCharger to 5.2.0 or newer.
Jun 1, 2021WP Super Cache: Did not properly sanitise its wp_cache_location parameter in its settingsCVE-2021-24329 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue.
- Product
- WP Super Cache
- Fixed in
- 1.7.3
- What to do
- Update WP Super Cache to 1.7.3 or newer.
Jun 1, 2021The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super CaCVE-2021-24312 · WordPress plugins & themes · reported by WPScanHigh 7.2
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
- Fixed in
- 1.7.3
- What to do
- Update the plugin to 1.7.3 or newer.
Apr 5, 2021WP Super Cache: Was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location optionCVE-2021-24209 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
- Product
- WP Super Cache
- Fixed in
- 1.7.2
- What to do
- Update WP Super Cache to 1.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2020WordPress WP Super Cache Plugin 1.2 has Remote PHP Code ExecutionCVE-2013-2009 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution
- Affected
- 1.2 to 1.2
- What to do
- Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 7, 2020WordPress Super Cache Plugin 1.3 has XSS.CVE-2013-2008 · WordPress plugins & themes · reported by Red HatMedium 6.1
WordPress Super Cache Plugin 1.3 has XSS.
- Affected
- 1.3 to 1.3
- What to do
- Affects 1.3 to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comopenwall.com
Dec 26, 2019WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code.CVE-2013-2011 · WordPress plugins & themes · reported by Red HatHigh 8.8
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009.
- Fixed in
- 1.3.2
- What to do
- Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Sep 13, 2019The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.CVE-2016-10947 · WordPress plugins & themes · reported by MITREHigh 7.2
The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
- Product
- Post Indexer
- Fixed in
- 3.0.6.2
- What to do
- Update Post Indexer to 3.0.6.2 or newer.
Full record and what to do →NVD recordadvisories.dxw.comadvisories.dxw.com
Jan 13, 2015Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject aCVE-2014-100026 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information.
- Product
- Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack
- Fixed in
- 1.4.8
- What to do
- Update Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack to 1.4.8 or newer.
Jan 20, 2014wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capabCVE-2010-5296 · WordPress plugins & themes · reported by MITREMedium 4.9
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
- Fixed in
- 3.0.2
- What to do
- Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Nov 17, 2008WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persiCVE-2008-5113 · WordPress plugins & themes · reported by MITREMedium 4
WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access). NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordbugs.debian.orgopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.