Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

11,366 results · page 222 of 228

Aug 2, 2021User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar): Did not sanitise or escape some of its settings before saving them and outputting them back in the pageCVE-2021-24450 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar)
Fixed in
3.1.8
What to do
Update User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021User Registration & User Profile – Profile Builder: Does not sanitise or escape its 'Modify default Redirect Delay timer' settingCVE-2021-24448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
User Registration & User Profile – Profile Builder
Fixed in
3.4.8
What to do
Update User Registration & User Profile – Profile Builder to 3.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
Product
About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
Fixed in
1.0.7
What to do
Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2021In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $CVE-2021-34630 · WordPress plugins & themes · reported by WordfenceMedium 5
In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jul 26, 2021woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks.CVE-2021-32789 · WordPress plugins & themes · reported by GitHubHigh 7.5
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jul 12, 2021Salon booking system: Does not properly sanitise and escape the First Name fieldCVE-2021-24429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.
Product
Salon booking system
Fixed in
6.3.1
What to do
Update Salon booking system to 6.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2021Smooth Scroll Page Up/Down Buttons: Does not properly sanitise and validate its psb_positioning settingsCVE-2021-24418 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_positioning settings, allowing high privilege users such as admin to set an XSS payload in it, which will be executed in all pages of the blog
Product
Smooth Scroll Page Up/Down Buttons
Affected
up to 1.4
What to do
Affects up to 1.4. Update Smooth Scroll Page Up/Down Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jul 12, 2021The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables.CVE-2021-24365 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns.
Fixed in
4.3.2
What to do
Update the plugin to 4.3.2 or newer.
Full record and what to do →NVD record wpscan.com syss.de
Jul 7, 2021A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users CVE-2021-34624 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for userCVE-2021-34623 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible fCVE-2021-34622 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible foCVE-2021-34621 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
Jul 6, 2021Jannah: Did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX actionCVE-2021-24407 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability.
Product
Jannah
Fixed in
5.4.5
What to do
Update Jannah to 5.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 6, 2021WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery: Did not properly sanitize the foodbakery_radius parameter before outputting it back in the responseCVE-2021-24389 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.
Product
WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery
Fixed in
2.2
What to do
Update WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery to 2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 6, 2021WP Pro Real Estate 7: Did not properly sanitise the ct_community parameter in its search listing page before outputting it back in itCVE-2021-24387 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
Product
WP Pro Real Estate 7
Fixed in
3.1.1
What to do
Update WP Pro Real Estate 7 to 3.1.1 or newer.
Full record and what to do →NVD record contempothemes.com wpscan.com
Jul 6, 2021Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPCVE-2021-24375 · WordPress plugins & themes · reported by WPScanCritical 9.8
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.
Product
Motor
Fixed in
3.1.0
What to do
Update Motor to 3.1.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Jun 21, 2021Fancy Product Designer: Allows unauthenticated attackers to upload arbitrary filesCVE-2021-24370 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
Product
Fancy Product Designer
Fixed in
4.6.9
What to do
Update Fancy Product Designer to 4.6.9 or newer.
Full record and what to do →NVD record lists.openwall.net seclists.org
Jun 21, 2021Admin Columns: And Admin Columns Pro WordPress plugin before 5CVE-2021-24366 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Admin Columns
Fixed in
4.3
What to do
Update Admin Columns to 4.3 or newer.
Full record and what to do →NVD record github.com wpscan.com
Jun 21, 2021Jannah: Did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the pageCVE-2021-24364 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
Product
Jannah
Fixed in
5.4.4
What to do
Update Jannah to 5.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameCVE-2021-24361 · WordPress plugins & themes · reported by WPScanCritical 9.8
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.
Product
Location Manager
Fixed in
2.1.0.10
What to do
Update Location Manager to 2.1.0.10 or newer.
Full record and what to do →NVD record wpgeodirectory.com wpscan.com
Jun 14, 2021The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored CrCVE-2021-24382 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.
Fixed in
3.5.0.9
What to do
Update the plugin to 3.5.0.9 or newer.
Full record and what to do →NVD record smartslider.helpscoutdocs.com wpscan.com
Jun 14, 2021Plus Addons for Elementor Page Builder: Did not properly check that a user requesting a password reset was the legitimate userCVE-2021-24359 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
Product
Plus Addons for Elementor Page Builder
Fixed in
4.1.11
What to do
Update Plus Addons for Elementor Page Builder to 4.1.11 or newer.
Full record and what to do →NVD record theplusaddons.com wpscan.com
Jun 14, 2021In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitisedCVE-2021-24357 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue.
Product
Best Image Gallery & Responsive Photo Gallery – FooGallery
Fixed in
2.0.35
What to do
Update Best Image Gallery & Responsive Photo Gallery – FooGallery to 2.0.35 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder: Did not properly sanitise some of its fieldsCVE-2021-24351 · WordPress plugins & themes · reported by WPScanMedium 6.1
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
Product
theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder
Fixed in
4.1.12
What to do
Update theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder to 4.1.12 or newer.
Full record and what to do →NVD record theplusaddons.com wpscan.com
Jun 14, 2021SP Project & Document Manager: Allows users to upload filesCVE-2021-24347 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
Product
SP Project & Document Manager
Fixed in
4.22
What to do
Update SP Project & Document Manager to 4.22 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jun 1, 2021Car Repair Services & Auto Mechanic: Did not properly sanitise its serviceestimatekey search parameter before outputting it back in the pageCVE-2021-24335 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
Product
Car Repair Services & Auto Mechanic
Fixed in
4.0
What to do
Update Car Repair Services & Auto Mechanic to 4.0 or newer.
Full record and what to do →NVD record m0ze.ru themeforest.net
Jun 1, 2021Instant Images – One Click Unsplash Uploads: Did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/uploadCVE-2021-24334 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue.
Product
Instant Images – One Click Unsplash Uploads
Fixed in
4.4.0.1
What to do
Update Instant Images – One Click Unsplash Uploads to 4.4.0.1 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Content Copy Protection & Prevent Image Save: Does not check for CSRFCVE-2021-24333 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.
Product
Content Copy Protection & Prevent Image Save
Affected
up to 1.3
What to do
Affects up to 1.3. Update Content Copy Protection & Prevent Image Save to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru m0ze.ru
Jun 1, 2021Smooth Scroll Page Up/Down Buttons: Did not properly sanitise and validate its settingsCVE-2021-24331 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psb_distance, psb_buttonsize, psb_speed, only validating them client side. This could allow high privilege users (such as admin) to set XSS payloads in them
Product
Smooth Scroll Page Up/Down Buttons
Fixed in
1.4
What to do
Update Smooth Scroll Page Up/Down Buttons to 1.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021WP Super Cache: Did not properly sanitise its wp_cache_location parameter in its settingsCVE-2021-24329 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue.
Product
WP Super Cache
Fixed in
1.7.3
What to do
Update WP Super Cache to 1.7.3 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise and escape its listing_list_viewCVE-2021-24320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.
Product
Bello - Directory & Listing
Fixed in
1.6.0
What to do
Update Bello - Directory & Listing to 1.6.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ pageCVE-2021-24319 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue
Product
Bello - Directory & Listing
Fixed in
1.6.0
What to do
Update Bello - Directory & Listing to 1.6.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Listeo: Did not properly sanitise some parameters in its SearchCVE-2021-24317 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues
Product
Listeo
Fixed in
1.6.11
What to do
Update Listeo to 1.6.11 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021search feature of the Mediumish: Does not properly sanitise it's 's' GET parameter before output it back the pageCVE-2021-24316 · WordPress plugins & themes · reported by WPScanMedium 6.1
The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page, leading to the Cross-SIte Scripting issue.
Product
search feature of the Mediumish
Affected
up to 1.0.47
What to do
Affects up to 1.0.47. Update search feature of the Mediumish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021WP Prayer: Provides the functionality to store requested prayers/praises and list them on a WordPress websiteCVE-2021-24313 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.
Product
WP Prayer
Fixed in
1.6.2
What to do
Update WP Prayer to 1.6.2 or newer.
Full record and what to do →NVD record bastijnouwendijk.com wpscan.com
Jun 1, 2021Photo Gallery by 10Web - Mobile-Friendly Image Gallery: Did not properly sanitise the gallery titleCVE-2021-24310 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117
Product
Photo Gallery by 10Web - Mobile-Friendly Image Gallery
Fixed in
1.5.67
What to do
Update Photo Gallery by 10Web - Mobile-Friendly Image Gallery to 1.5.67 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 1, 2021Schedule Name" input in the Weekly Schedule: General options did not properly sanitize inputCVE-2021-24309 · WordPress plugins & themes · reported by WPScanMedium 5.4
The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the <script> HTML tags and cause a stored XSS issue
Product
Schedule Name" input in the Weekly Schedule
Fixed in
3.4.3
What to do
Update Schedule Name" input in the Weekly Schedule to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021Autoptimize: Was missing proper escaping and sanitisation in some of its settingsCVE-2021-24332 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
Product
Autoptimize
Fixed in
2.8.4
What to do
Update Autoptimize to 2.8.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
Fixed in
4.21.1
What to do
Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
May 24, 2021The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilCVE-2021-24307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.
Fixed in
4.1.0.2
What to do
Update the plugin to 4.1.0.2 or newer.
Full record and what to do →NVD record aioseo.com wpscan.com
May 24, 2021Ultimate Member – User Profile, User Registration, Login & Membership: Did not properly sanitiseCVE-2021-24306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.
Product
Ultimate Member – User Profile, User Registration, Login & Membership
Fixed in
2.1.20
What to do
Update Ultimate Member – User Profile, User Registration, Login & Membership to 2.1.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021slider import search feature of the PickPlugins Product Slider for WooCommerce: Did not properly sanitised the keyword GET parameterCVE-2021-24300 · WordPress plugins & themes · reported by WPScanMedium 6.1
The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue
Product
slider import search feature of the PickPlugins Product Slider for WooCommerce
Fixed in
1.13.22
What to do
Update slider import search feature of the PickPlugins Product Slider for WooCommerce to 1.13.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021Goto: Did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX actionCVE-2021-24297 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
Product
Goto
Fixed in
2.1
What to do
Update Goto to 2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high CVE-2021-24323 · WordPress plugins & themes · reported by WPScanMedium 4.8
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
Fixed in
5.2.0
What to do
Update the plugin to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021ReDi Restaurant Reservation: Provides the functionality to let users make restaurant reservationsCVE-2021-24299 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.
Product
ReDi Restaurant Reservation
Fixed in
21.0426
What to do
Update ReDi Restaurant Reservation to 21.0426 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 17, 2021It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress PluCVE-2021-24295 · WordPress plugins & themes · reported by WPScanHigh 7.5
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
Product
Spam protection, AntiSpam, FireWall by CleanTalk
Fixed in
5.153.4
What to do
Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.153.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 17, 2021Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor: Have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.
Product
Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor
Fixed in
2.24.0
What to do
Update Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor to 2.24.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 17, 2021When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized.CVE-2021-24288 · WordPress plugins & themes · reported by WPScanMedium 6.1
When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.
Fixed in
7.5.0
What to do
Update the plugin to 7.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24287 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
Product
settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
Fixed in
1.3.2
What to do
Update settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons to 1.3.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 14, 2021settings page of the Redirect 404 to parent: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24286 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
Product
settings page of the Redirect 404 to parent
Fixed in
1.3.1
What to do
Update settings page of the Redirect 404 to parent to 1.3.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.