Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

486new WordPress flaws this week

395,358entries in the database

12,570 results · page 235 of 252

Mar 23, 2022Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to injectCVE-2022-25609 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 23, 2022Ninja Forms - File Uploads Extension: Reflected cross-site scriptingCVE-2022-0889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
Product
Ninja Forms - File Uploads Extension
Affected
up to 3.3.12
What to do
Affects up to 3.3.12. Update Ninja Forms - File Uploads Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ninjaforms.com wordfence.com
Mar 23, 2022Amelia: Cross-Site ScriptingCVE-2022-0834 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user accesses the booking calendar with the date the attacker has injected the malicious payload into. This affects versions up to and including 1.0.46.
Product
Amelia
Affected
up to 1.0.46
What to do
Affects up to 1.0.46. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 23, 2022Photoswipe Masonry Gallery: Cross-Site ScriptingCVE-2022-0750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
Product
Photoswipe Masonry Gallery
Affected
up to 1.2.14
What to do
Affects up to 1.2.14. Update Photoswipe Masonry Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 18, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25605 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.
Affected
up to 1.68.6
What to do
Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2).CVE-2022-25604 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2).
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).CVE-2022-25603 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).
Affected
6.2.5 to 6.2.5
What to do
Affects 6.2.5 to 6.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress pluCVE-2021-23209 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress plugin (versions <= 1.0.77.32).
Affected
up to 1.0.77.32
What to do
Affects up to 1.0.77.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.CVE-2021-23150 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.
Affected
up to 1.0.77.31
What to do
Affects up to 1.0.77.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 11, 2022Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).CVE-2022-25601 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
Affected
up to 2.4
What to do
Affects up to 2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Mar 7, 2022Ditty (formerly Ditty News Ticker): Is affected by a Reflected Cross-Site Scripting (XSS) vulnerabilityCVE-2022-0533 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
Product
Ditty (formerly Ditty News Ticker)
Fixed in
3.0.15
What to do
Update Ditty (formerly Ditty News Ticker) to 3.0.15 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25307 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Product
WP Statistics
Affected
up to 13.1.5
What to do
Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25306 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Product
WP Statistics
Affected
up to 13.1.5
What to do
Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25305 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Product
WP Statistics
Affected
up to 13.1.5
What to do
Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 24, 2022Header Footer Code Manager plugin <= 1.1.16: Reflected Cross-Site Scripting (XSS)CVE-2022-0710 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter.
Product
Header Footer Code Manager plugin <= 1.1.16
Affected
up to 1.1.16
What to do
Affects up to 1.1.16. Update Header Footer Code Manager plugin <= 1.1.16 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Feb 24, 2022Essential Addons for Elementor Lite: Cross-Site ScriptingCVE-2022-0683 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the ~/includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 5.0.8.
Product
Essential Addons for Elementor Lite
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update Essential Addons for Elementor Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
Product
Profile Builder – User Profile & User Registration Forms
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 21, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).CVE-2021-26256 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 21, 2022Image Photo Gallery Final Tiles Grid: Does not sanitise and escape the Description fieldCVE-2022-0186 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
Product
Image Photo Gallery Final Tiles Grid
Fixed in
3.5.3
What to do
Update Image Photo Gallery Final Tiles Grid to 3.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
Product
Buffer Button
Affected
up to 1.0
What to do
Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
Product
Translation Exchange
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.CVE-2021-25055 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
Product
FeedWordPress
Fixed in
2022.0123
What to do
Update FeedWordPress to 2022.0123 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022WP Photo Album Plus: Was vulnerable to Stored Cross-Site Scripting (XSS)CVE-2021-25115 · WordPress plugins & themes · reported by WPScanMedium 6.4
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
Product
WP Photo Album Plus
Fixed in
8.0.10
What to do
Update WP Photo Album Plus to 8.0.10 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022WooCommerce Stored Exporter: Was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin pageCVE-2022-0149 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
Product
WooCommerce Stored Exporter
Fixed in
2.7.1
What to do
Update WooCommerce Stored Exporter to 2.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 4, 2022Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'.CVE-2022-23980 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'.
Affected
up to 2.9.9
What to do
Affects up to 2.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 4, 2022Embed Swagger: Reflected Cross-Site ScriptingCVE-2022-0381 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.
Product
Embed Swagger
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Embed Swagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 4, 2022Fotobook: Reflected Cross-Site ScriptingCVE-2022-0380 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF'] found in the ~/options-fotobook.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 3.2.3.
Product
Fotobook
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Fotobook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not have CSRF check in placeCVE-2021-25072 · WordPress plugins & themes · reported by WPScanMedium 6.5
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack
Product
NextScripts: Social Networks Auto-Poster
Fixed in
4.3.25
What to do
Update NextScripts: Social Networks Auto-Poster to 4.3.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not sanitise and escape logged requests before outputting them in the related admin dashboardCVE-2021-24975 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
Product
NextScripts: Social Networks Auto-Poster
Fixed in
4.3.24
What to do
Update NextScripts: Social Networks Auto-Poster to 4.3.24 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 28, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).CVE-2022-23979 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
Affected
up to 3.0.15
What to do
Affects up to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jan 28, 2022Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameCVE-2021-23174 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 18, 2022ProfileGrid – User Profiles, Memberships, Groups and Communities: Stored Cross-Site ScriptingCVE-2022-0233 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
Product
ProfileGrid – User Profiles, Memberships, Groups and Communities
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update ProfileGrid – User Profiles, Memberships, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 18, 2022User Registration, Login & Landing Pages: Stored Cross-Site ScriptingCVE-2022-0232 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
User Registration, Login & Landing Pages
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update User Registration, Login & Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 18, 2022Random Banner: Stored Cross-Site ScriptingCVE-2022-0210 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/models/model.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Random Banner
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Random Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 18, 2022WHMCS Bridge: Stored Cross-Site ScriptingCVE-2021-4074 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the cc_whmcs_bridge_add_admin function, low-level authenticated users such as subscribers can exploit this vulnerability.
Product
WHMCS Bridge
Affected
up to 6.1
What to do
Affects up to 6.1. Update WHMCS Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2022SEUR Oficial: Does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-25005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
SEUR Oficial
Fixed in
1.7.0
What to do
Update SEUR Oficial to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Stored cross-site scriptingCVE-2022-0182 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Reflected cross-site scriptingCVE-2022-0181 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Jan 14, 2022Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).CVE-2021-36920 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jan 10, 202210Web Social Photo Feed: Was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin pageCVE-2021-25047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users
Product
10Web Social Photo Feed
Fixed in
1.4.29
What to do
Update 10Web Social Photo Feed to 1.4.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022WP Travel Engine: Does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pagesCVE-2021-24680 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
Product
WP Travel Engine
Fixed in
5.3.1
What to do
Update WP Travel Engine to 5.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 22, 2021Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).CVE-2021-36885 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
Affected
up to 1.2.6.1
What to do
Affects up to 1.2.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 20, 2021Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versCVE-2021-36889 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
Affected
up to 1.6
What to do
Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 20, 2021Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugCVE-2021-36887 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 14, 2021Variation Swatches for WooCommerce: Stored Cross-Site ScriptingCVE-2021-42367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization checks on the tawcvs_save_settings function, low-level authenticated users such as subscribers can exploit this vulnerability.
Product
Variation Swatches for WooCommerce
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Variation Swatches for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Fathom Analytics: Stored Cross-Site ScriptingCVE-2021-41836 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the $site_id parameter found in the ~/fathom-analytics.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.0.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Fathom Analytics
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Fathom Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021duoFAQ - Responsive, Flat, Simple FAQ WordPess: Reflected Cross-Site ScriptingCVE-2021-39319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.
Product
duoFAQ - Responsive, Flat, Simple FAQ WordPess
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update duoFAQ - Responsive, Flat, Simple FAQ WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021H5P CSS Editor: Reflected Cross-Site ScriptingCVE-2021-39318 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
H5P CSS Editor
Affected
up to 1.0
What to do
Affects up to 1.0. Update H5P CSS Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Magic Post Voice: Reflected Cross-Site ScriptingCVE-2021-39315 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
Magic Post Voice
Affected
up to 1.2
What to do
Affects up to 1.2. Update Magic Post Voice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021WooCommerce EnvioPack: Reflected Cross-Site ScriptingCVE-2021-39314 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
WooCommerce EnvioPack
Affected
up to 1.2
What to do
Affects up to 1.2. Update WooCommerce EnvioPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.