Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

1,102 results · page 21 of 23

Feb 28, 2022The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server CVE-2021-24689 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack
Product
Contact Forms - Drag & Drop Contact Form Builder
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Contact Forms - Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
Product
Profile Builder – User Profile & User Registration Forms
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
Product
GiveWP
Fixed in
2.17.3
What to do
Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the lang and pid parameter before outputting them back in attributesCVE-2021-24874 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Fixed in
3.1.31
What to do
Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages: Does not check for authorisation and has a flawed CSRF logicCVE-2021-25106 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages
Fixed in
2.7.1
What to do
Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Easy Forms for Mailchimp: Does not sanitise and escape the field_name and field_type parameters before outputting them back in attributesCVE-2021-24985 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Easy Forms for Mailchimp
Fixed in
6.8.6
What to do
Update Easy Forms for Mailchimp to 6.8.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the sib-statistics-date parameter before outputting it back in an attributeCVE-2021-24923 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Fixed in
3.1.25
What to do
Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Typebot | Build beautiful conversational forms: Does not sanitise and escape the Publish ID settingCVE-2021-24902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Typebot | Build beautiful conversational forms
Fixed in
1.4.3
What to do
Update Typebot | Build beautiful conversational forms to 1.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021Caldera Forms: Does not sanitise and escape the Form Name before outputting it in attributesCVE-2021-24896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Caldera Forms
Fixed in
1.9.5
What to do
Update Caldera Forms to 1.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021NEX-Forms: Does not have CSRF checks in placeCVE-2021-24705 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them
Product
NEX-Forms
Fixed in
8.4.3
What to do
Update NEX-Forms to 8.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
Product
Ninja Forms Contact Form
Fixed in
3.6.4
What to do
Update Ninja Forms Contact Form to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's emCVE-2021-24892 · WordPress plugins & themes · reported by WPScanHigh 8.8
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
Fixed in
1.6.9
What to do
Update the plugin to 1.6.9 or newer.
Full record and what to do →NVD record github.com wpscan.com
Nov 19, 2021Easy Registration Forms: Cross-Site Request ForgeryCVE-2021-39353 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found in the ~/includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 2.1.1.
Product
Easy Registration Forms
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Easy Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpCVE-2021-24731 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
Product
Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
Fixed in
3.7.1.6
What to do
Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.7.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Has a flaw in the social login implementationCVE-2021-24647 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
Product
Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
Fixed in
3.1.7.6
What to do
Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Wow Forms: Does not sanitise or escape a 'did' GET parameter before using it in a SQL statementCVE-2021-24628 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection
Product
Wow Forms
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Wow Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Oct 25, 2021WordPress Contact Forms by Cimatti: Does not sanitise and escape the Form Title before outputting it in some admin pagesCVE-2021-24744 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
WordPress Contact Forms by Cimatti
Fixed in
1.4.12
What to do
Update WordPress Contact Forms by Cimatti to 1.4.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for: Does not sanitise and escape its Form's LabelsCVE-2021-24608 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for
Fixed in
5.0.07
What to do
Update Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for to 5.0.07 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Ninja Forms Contact Form
Fixed in
3.5.8.2
What to do
Update Ninja Forms Contact Form to 3.5.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021PlanSo Forms: Does not escape the title of its Form before outputting it in attributesCVE-2021-24516 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
Product
PlanSo Forms
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update PlanSo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021PostX – Gutenberg Blocks for Post Grid: Performs incorrect checks before allowing any logged in user to perform some ajax based requestsCVE-2021-24652 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.
Product
PostX – Gutenberg Blocks for Post Grid
Fixed in
2.4.10
What to do
Update PostX – Gutenberg Blocks for Post Grid to 2.4.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 22, 2021Ninja Forms: Arbitrary email sendingCVE-2021-34648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.
Product
Ninja Forms
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2021Ninja Forms: Sensitive information disclosureCVE-2021-34647 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.
Product
Ninja Forms
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 20, 2021youForms for: Does not sanitise escape the Button Text field of its TemplatesCVE-2021-24596 · WordPress plugins & themes · reported by WPScanMedium 4.8
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
youForms for
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update youForms for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 10, 2021Wise Agent Capture Forms: Reflected Cross-Site ScriptingCVE-2021-38335 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
Wise Agent Capture Forms
Affected
up to 1.0
What to do
Affects up to 1.0. Update Wise Agent Capture Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2021.18
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2021.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021Form Builder | Create Responsive Contact Forms: Does not sanitise or escape its Form TitleCVE-2021-24513 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
Product
Form Builder | Create Responsive Contact Forms
Fixed in
1.9.8.4
What to do
Update Form Builder | Create Responsive Contact Forms to 1.9.8.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not escape the Donation Level setting of its Donation FormsCVE-2021-24524 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.
Product
GiveWP – Donation Plugin and Fundraising Platform
Fixed in
2.12.0
What to do
Update GiveWP – Donation Plugin and Fundraising Platform to 2.12.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 9, 2021Forms: Did not sanitise its input fieldsCVE-2021-24505 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field.
Product
Forms
Fixed in
1.12.3
What to do
Update Forms to 1.12.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 7, 2021WP Fluent Forms plugin < 3.6.67: Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege EscalationCVE-2021-34620 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
Product
WP Fluent Forms plugin < 3.6.67
What to do
Update WP Fluent Forms plugin < 3.6.67 to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 22, 2021Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments: Does not sanitise the invitaion_code GET parameterCVE-2021-24239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
Product
Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments
Fixed in
3.7.0.1
What to do
Update Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments to 3.7.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 22, 2021The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reCVE-2021-24234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record wpscan.com getastra.com
Apr 5, 2021wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for: Had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connectionCVE-2021-24166 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.
Product
wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for
Fixed in
3.4.34
What to do
Update wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for to 3.4.34 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a useCVE-2021-24165 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
Product
Ninja Forms Contact Form
Fixed in
3.4.34
What to do
Update Ninja Forms Contact Form to 3.4.34 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and rCVE-2021-24164 · WordPress plugins & themes · reported by WPScanMedium 4.3
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
Product
Ninja Forms Contact Form
Fixed in
3.4.34.1
What to do
Update Ninja Forms Contact Form to 3.4.34.1 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore makinCVE-2021-24163 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
Fixed in
3.4.34
What to do
Update the plugin to 3.4.34 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Mar 18, 2021Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site ScriptinCVE-2021-24134 · WordPress plugins & themes · reported by WPScanMedium 4.8
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
Product
Constant Contact Forms
Fixed in
1.8.8
What to do
Update Constant Contact Forms to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.CVE-2020-36175 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
Product
Ninja Forms
Fixed in
3.4.27.1
What to do
Update Ninja Forms to 3.4.27.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.CVE-2020-36174 · WordPress plugins & themes · reported by MITREMedium 6.5
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
Product
Ninja Forms
Fixed in
3.4.27.1
What to do
Update Ninja Forms to 3.4.27.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 6, 2021The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.CVE-2020-36173 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
Product
Ninja Forms
Fixed in
3.4.28
What to do
Update Ninja Forms to 3.4.28 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 6, 2021The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.CVE-2020-36170 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.
Product
Ultimate Member
Fixed in
2.1.13
What to do
Update Ultimate Member to 2.1.13 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Nov 4, 2020WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.CVE-2020-22276 · WordPress plugins & themes · reported by MITRECritical 9.8
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.
Affected
1.4.7 to 1.4.7
What to do
Affects 1.4.7 to 1.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record uploadboy.com cert.ikiu.ac.ir
Nov 4, 2020Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands.CVE-2020-22275 · WordPress plugins & themes · reported by MITREHigh 8.8
Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable.
Affected
2.0.6 to 2.0.6
What to do
Affects 2.0.6 to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record uploadboy.com cert.ikiu.ac.ir
Jun 22, 2020the forms it presents, allowing the possibility of deleting records: The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF)CVE-2020-13426 · WordPress plugins & themes · reported by MITREMedium 6.5
The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.
Product
the forms it presents, allowing the possibility of deleting records
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the forms it presents, allowing the possibility of deleting records to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record 0day.today cxsecurity.com
Jun 2, 2020common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_usCVE-2020-13764 · WordPress plugins & themes · reported by MITREHigh 7.5
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
Product
common.php in the Gravity Forms
Fixed in
2.4.9
What to do
Update common.php in the Gravity Forms to 2.4.9 or newer.
Full record and what to do →NVD record docs.gravityforms.com github.com
Apr 29, 2020The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.CVE-2020-12462 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
Product
ninja-forms
Fixed in
3.4.24.2
What to do
Update ninja-forms to 3.4.24.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 24, 2020A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.CVE-2020-10385 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
Product
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite)
Fixed in
1.5.9
What to do
Update A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) to 1.5.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and chaCVE-2020-9457 · WordPress plugins & themes · reported by MITREHigh 8.8
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 14, 2020The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninjCVE-2020-8594 · WordPress plugins & themes · reported by MITREMedium 5.4
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].
Affected
3.4.22 to 3.4.22
What to do
Affects 3.4.22 to 3.4.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record spider-security.co.uk wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.