Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,061 results · page 20 of 22
Sep 5, 2022Simple Payment Donations & Subscriptions: Does not sanitise and escape user input given in its formsCVE-2022-2565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
- Product
- Simple Payment Donations & Subscriptions
- Fixed in
- 4.2.1
- What to do
- Update Simple Payment Donations & Subscriptions to 4.2.1 or newer.
Aug 8, 2022weForms: Does not sanitise and escape its settingsCVE-2022-2395 · WordPress plugins & themes · reported by WPScanMedium 4.8
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- weForms
- Fixed in
- 1.6.14
- What to do
- Update weForms to 1.6.14 or newer.
Aug 5, 2022MailerLite – Signup forms: Cross-Site Request Forgery (CSRF)CVE-2022-33201 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.
- Product
- MailerLite – Signup forms
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update MailerLite – Signup forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 4, 2022Ninja Forms Contact Form: Does not sanitize and escape some imported dataCVE-2021-25066 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.10
- What to do
- Update Ninja Forms Contact Form to 3.6.10 or newer.
Jul 4, 2022Ninja Forms Contact Form: Does not sanitise and escape field labelsCVE-2021-25056 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.10
- What to do
- Update Ninja Forms Contact Form to 3.6.10 or newer.
Jun 16, 2022Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36827 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
- Product
- Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at
- Affected
- up to 3.6.9
- What to do
- Affects up to 3.6.9. Update Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 16, 2022The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary CVE-2022-1386 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
- Product
- Fusion Builder
- Fixed in
- 3.6.2
- What to do
- Update Fusion Builder to 3.6.2 or newer.
Full record and what to do →NVD recordtheme-fusion.comwpscan.com
Apr 18, 2022Caldera Forms: Does not validate and escape the cf-api parameter before outputting it back in the responseCVE-2022-0879 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- Caldera Forms
- Fixed in
- 1.9.7
- What to do
- Update Caldera Forms to 1.9.7 or newer.
Mar 23, 2022Ninja Forms - File Uploads Extension: Reflected cross-site scriptingCVE-2022-0889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
- Product
- Ninja Forms - File Uploads Extension
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update Ninja Forms - File Uploads Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordninjaforms.comwordfence.com
Mar 23, 2022Ninja Forms - File Uploads Extension: Arbitrary file uploadsCVE-2022-0888 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0
- Product
- Ninja Forms - File Uploads Extension
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Ninja Forms - File Uploads Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comwordfence.com
Mar 7, 2022Smart Forms: Does not have authorisation in its rednao_smart_forms_entries_list AJAX actionCVE-2022-0163 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form.
- Product
- Smart Forms
- Fixed in
- 2.6.71
- What to do
- Update Smart Forms to 2.6.71 or newer.
Feb 28, 2022In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unCVE-2021-24704 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
- Product
- Orange Form
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server CVE-2021-24689 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack
- Product
- Contact Forms - Drag & Drop Contact Form Builder
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Contact Forms - Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the lang and pid parameter before outputting them back in attributesCVE-2021-24874 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.31
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.31 or newer.
Jan 24, 2022Easy Forms for Mailchimp: Does not sanitise and escape the field_name and field_type parameters before outputting them back in attributesCVE-2021-24985 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.6
- What to do
- Update Easy Forms for Mailchimp to 6.8.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the sib-statistics-date parameter before outputting it back in an attributeCVE-2021-24923 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.25
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.25 or newer.
Dec 27, 2021Typebot | Build beautiful conversational forms: Does not sanitise and escape the Publish ID settingCVE-2021-24902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Typebot | Build beautiful conversational forms
- Fixed in
- 1.4.3
- What to do
- Update Typebot | Build beautiful conversational forms to 1.4.3 or newer.
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- User Registration, Login Form, User Profile & Membership
- Fixed in
- 3.2.3
- What to do
- Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 13, 2021Caldera Forms: Does not sanitise and escape the Form Name before outputting it in attributesCVE-2021-24896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Caldera Forms
- Fixed in
- 1.9.5
- What to do
- Update Caldera Forms to 1.9.5 or newer.
Dec 13, 2021NEX-Forms: Does not have CSRF checks in placeCVE-2021-24705 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them
- Product
- NEX-Forms
- Fixed in
- 8.4.3
- What to do
- Update NEX-Forms to 8.4.3 or newer.
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.4
- What to do
- Update Ninja Forms Contact Form to 3.6.4 or newer.
Nov 23, 2021Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's emCVE-2021-24892 · WordPress plugins & themes · reported by WPScanHigh 8.8
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
- Fixed in
- 1.6.9
- What to do
- Update the plugin to 1.6.9 or newer.
Nov 19, 2021Easy Registration Forms: Cross-Site Request ForgeryCVE-2021-39353 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found in the ~/includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 2.1.1.
- Product
- Easy Registration Forms
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Easy Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpCVE-2021-24731 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
- Product
- Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
- Fixed in
- 3.7.1.6
- What to do
- Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.7.1.6 or newer.
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Has a flaw in the social login implementationCVE-2021-24647 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
- Product
- Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
- Fixed in
- 3.1.7.6
- What to do
- Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.1.7.6 or newer.
Nov 8, 2021Wow Forms: Does not sanitise or escape a 'did' GET parameter before using it in a SQL statementCVE-2021-24628 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection
- Product
- Wow Forms
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Wow Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Oct 25, 2021WordPress Contact Forms by Cimatti: Does not sanitise and escape the Form Title before outputting it in some admin pagesCVE-2021-24744 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- WordPress Contact Forms by Cimatti
- Fixed in
- 1.4.12
- What to do
- Update WordPress Contact Forms by Cimatti to 1.4.12 or newer.
Oct 25, 2021Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for: Does not sanitise and escape its Form's LabelsCVE-2021-24608 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for
- Fixed in
- 5.0.07
- What to do
- Update Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for to 5.0.07 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.5.8.2
- What to do
- Update Ninja Forms Contact Form to 3.5.8.2 or newer.
Oct 18, 2021PlanSo Forms: Does not escape the title of its Form before outputting it in attributesCVE-2021-24516 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
- Product
- PlanSo Forms
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update PlanSo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 27, 2021PostX – Gutenberg Blocks for Post Grid: Performs incorrect checks before allowing any logged in user to perform some ajax based requestsCVE-2021-24652 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.
- Product
- PostX – Gutenberg Blocks for Post Grid
- Fixed in
- 2.4.10
- What to do
- Update PostX – Gutenberg Blocks for Post Grid to 2.4.10 or newer.
Sep 22, 2021Ninja Forms: Arbitrary email sendingCVE-2021-34648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.
- Product
- Ninja Forms
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 22, 2021Ninja Forms: Sensitive information disclosureCVE-2021-34647 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.
- Product
- Ninja Forms
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 20, 2021youForms for: Does not sanitise escape the Button Text field of its TemplatesCVE-2021-24596 · WordPress plugins & themes · reported by WPScanMedium 4.8
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- youForms for
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update youForms for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2021Wise Agent Capture Forms: Reflected Cross-Site ScriptingCVE-2021-38335 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
- Product
- Wise Agent Capture Forms
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Wise Agent Capture Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2021.18
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2021.18 or newer.
Sep 6, 2021Form Builder | Create Responsive Contact Forms: Does not sanitise or escape its Form TitleCVE-2021-24513 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
- Product
- Form Builder | Create Responsive Contact Forms
- Fixed in
- 1.9.8.4
- What to do
- Update Form Builder | Create Responsive Contact Forms to 1.9.8.4 or newer.
Aug 23, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not escape the Donation Level setting of its Donation FormsCVE-2021-24524 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.12.0
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.12.0 or newer.
Aug 9, 2021Forms: Did not sanitise its input fieldsCVE-2021-24505 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field.
- Product
- Forms
- Fixed in
- 1.12.3
- What to do
- Update Forms to 1.12.3 or newer.
Jul 7, 2021WP Fluent Forms plugin < 3.6.67: Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege EscalationCVE-2021-34620 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
- Product
- WP Fluent Forms plugin < 3.6.67
- What to do
- Update WP Fluent Forms plugin < 3.6.67 to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 22, 2021Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments: Does not sanitise the invitaion_code GET parameterCVE-2021-24239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
- Product
- Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments
- Fixed in
- 3.7.0.1
- What to do
- Update Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments to 3.7.0.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 22, 2021The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reCVE-2021-24234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.
- Fixed in
- 4.6.1
- What to do
- Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD recordwpscan.comgetastra.com
Apr 5, 2021wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for: Had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connectionCVE-2021-24166 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.
- Product
- wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for
- Fixed in
- 3.4.34
- What to do
- Update wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for to 3.4.34 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a useCVE-2021-24165 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.4.34
- What to do
- Update Ninja Forms Contact Form to 3.4.34 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and rCVE-2021-24164 · WordPress plugins & themes · reported by WPScanMedium 4.3
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.4.34.1
- What to do
- Update Ninja Forms Contact Form to 3.4.34.1 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore makinCVE-2021-24163 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
- Fixed in
- 3.4.34
- What to do
- Update the plugin to 3.4.34 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Mar 18, 2021Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site ScriptinCVE-2021-24134 · WordPress plugins & themes · reported by WPScanMedium 4.8
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
- Product
- Constant Contact Forms
- Fixed in
- 1.8.8
- What to do
- Update Constant Contact Forms to 1.8.8 or newer.
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.CVE-2020-36175 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
- Product
- Ninja Forms
- Fixed in
- 3.4.27.1
- What to do
- Update Ninja Forms to 3.4.27.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.