Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

549new WordPress flaws this week

391,964entries in the database

1,491 results · page 26 of 30

Mar 11, 2022Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).CVE-2022-25601 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
Affected
up to 2.4
What to do
Affects up to 2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Mar 11, 2022Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3)CVE-2022-25600 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Mar 7, 2022Ditty (formerly Ditty News Ticker): Is affected by a Reflected Cross-Site Scripting (XSS) vulnerabilityCVE-2022-0533 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
Product
Ditty (formerly Ditty News Ticker)
Fixed in
3.0.15
What to do
Update Ditty (formerly Ditty News Ticker) to 3.0.15 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022Email Subscribers & Newsletters: Does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` actionCVE-2022-0439 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
Product
Email Subscribers & Newsletters
Fixed in
5.3.2
What to do
Update Email Subscribers & Newsletters to 5.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022Product Feed PRO for WooCommerce: Does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user)CVE-2022-0426 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Product
Product Feed PRO for WooCommerce
Fixed in
11.2.3
What to do
Update Product Feed PRO for WooCommerce to 11.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022Video Conferencing with Zoom: Does not have authorisation in its vczapi_get_wp_users AJAX actionCVE-2022-0384 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog
Product
Video Conferencing with Zoom
Fixed in
3.8.17
What to do
Update Video Conferencing with Zoom to 3.8.17 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022test parameter of the xmlfeed in the Tradetracker-Store: Is not sanitisedCVE-2021-24778 · WordPress plugins & themes · reported by WPScanHigh 7.2
The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
test parameter of the xmlfeed in the Tradetracker-Store
Fixed in
4.6.60
What to do
Update test parameter of the xmlfeed in the Tradetracker-Store to 4.6.60 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WP RSS Aggregator: Does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the responseCVE-2022-0189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Product
WP RSS Aggregator
Fixed in
4.20
What to do
Update WP RSS Aggregator to 4.20 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints wCVE-2021-25118 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022AnyComment: Is affected by a race conditionCVE-2022-0279 · WordPress plugins & themes · reported by WPScanLow 3.1
The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users
Product
AnyComment
Fixed in
0.2.18
What to do
Update AnyComment to 0.2.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022AnyComment: Does not have CSRF checks in the Import and Revert HyperComments featuresCVE-2022-0134 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
Product
AnyComment
Fixed in
0.2.18
What to do
Update AnyComment to 0.2.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022ExportFeed: Does not sanitise and escape the product_id POST parameter before using it in a SQL statementCVE-2021-4208 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users
Product
ExportFeed
Affected
up to 2.0.1.0
What to do
Affects up to 2.0.1.0. Update ExportFeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
Product
Buffer Button
Affected
up to 1.0
What to do
Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.CVE-2021-25055 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
Product
FeedWordPress
Fixed in
2022.0123
What to do
Update FeedWordPress to 2022.0123 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 18, 2022The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.CVE-2022-23982 · WordPress plugins & themes · reported by PatchstackMedium 4.3
The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 18, 2022The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).CVE-2022-23981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 14, 2022Ad Invalid Click Protector (AICP): Is affected by a SQL Injection in the id parameter of the delete actionCVE-2022-0190 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action.
Product
Ad Invalid Click Protector (AICP)
Fixed in
1.2.6
What to do
Update Ad Invalid Click Protector (AICP) to 1.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Futurio Extra: Is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the databaseCVE-2021-25109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
Product
Futurio Extra
Fixed in
1.6.3
What to do
Update Futurio Extra to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022WooCommerce Stored Exporter: Was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin pageCVE-2022-0149 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
Product
WooCommerce Stored Exporter
Fixed in
2.7.1
What to do
Update WooCommerce Stored Exporter to 2.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 1, 2022Asset CleanUp: Page Speed Booster: Does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users)CVE-2021-24983 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issue
Product
Asset CleanUp: Page Speed Booster
Fixed in
1.3.8.5
What to do
Update Asset CleanUp: Page Speed Booster to 1.3.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Perfect Survey: Does not validate and escape the X-Forwarded-For header value before outputting it in the statistic pageCVE-2021-24765 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue
Product
Perfect Survey
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Perfect Survey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Perfect Survey: Does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics pageCVE-2021-24764 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics page, type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripting issues
Product
Perfect Survey
Fixed in
1.5.2
What to do
Update Perfect Survey to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Perfect Survey: Does not have proper authorisation nor CSRF checks in the save_global_setting AJAX actionCVE-2021-24763 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey
Product
Perfect Survey
Fixed in
1.5.2
What to do
Update Perfect Survey to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Perfect Survey: Does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX actionCVE-2021-24762 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
Product
Perfect Survey
Fixed in
1.5.2
What to do
Update Perfect Survey to 1.5.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jan 24, 2022Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier): Does not escape the effects parameter before outputting it back in an attribute in an admin pageCVE-2021-25031 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)
Fixed in
9.7.1
What to do
Update Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) to 9.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Code Snippets: Does not escape the snippets-safe-mode parameter before outputting it back in attributesCVE-2021-25008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue
Product
Code Snippets
Fixed in
2.14.3
What to do
Update Code Snippets to 2.14.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Product Feed PRO for WooCommerce: Does not have authorisation and CSRF check in some of its AJAX actionsCVE-2021-24974 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.
Product
Product Feed PRO for WooCommerce
Fixed in
11.0.7
What to do
Update Product Feed PRO for WooCommerce to 11.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022Landing Page Builder: Was affected by a reflected XSS in page-builder-add on the ulpb_post admin pageCVE-2021-25067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.
Product
Landing Page Builder
Fixed in
1.4.9.6
What to do
Update Landing Page Builder to 1.4.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022Smash Balloon Social Post Feed: Was affected by a reflected XSS in custom-facebook-feed in cff-top admin pageCVE-2021-25065 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
Product
Smash Balloon Social Post Feed
Fixed in
4.1.1
What to do
Update Smash Balloon Social Post Feed to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022WP Booking System: Was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin pageCVE-2021-25061 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.
Product
WP Booking System
Fixed in
2.0.15
What to do
Update WP Booking System to 2.0.15 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 17, 2022All in One SEO: Is affected by an authenticated SQL injection issueCVE-2021-25037 · WordPress plugins & themes · reported by WPScanMedium 6.5
The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords).
Product
All in One SEO
Fixed in
4.1.5.3
What to do
Update All in One SEO to 4.1.5.3 or newer.
Full record and what to do →NVD record jetpack.com plugins.trac.wordpress.org
Jan 17, 2022All in One SEO: Is affected by a Privilege Escalation issueCVE-2021-25036 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.
Product
All in One SEO
Fixed in
4.1.5.3
What to do
Update All in One SEO to 4.1.5.3 or newer.
Full record and what to do →NVD record jetpack.com plugins.trac.wordpress.org
Jan 10, 202210Web Social Photo Feed: Was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin pageCVE-2021-25047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users
Product
10Web Social Photo Feed
Fixed in
1.4.29
What to do
Update 10Web Social Photo Feed to 1.4.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2021Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPreCVE-2021-36888 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
Affected
up to 9.6.1
What to do
Affects up to 9.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 13, 2021Auto Featured Image (Auto Post Thumbnail): Does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS blockCVE-2021-24932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue.
Product
Auto Featured Image (Auto Post Thumbnail)
Fixed in
3.9.3
What to do
Update Auto Featured Image (Auto Post Thumbnail) to 3.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Smash Balloon Social Post Feed: Did not have any privilege or nonce validation before saving the plugin's settingCVE-2021-24918 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
Product
Smash Balloon Social Post Feed
Fixed in
4.0.1
What to do
Update Smash Balloon Social Post Feed to 4.0.1 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Nov 23, 2021Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's emCVE-2021-24892 · WordPress plugins & themes · reported by WPScanHigh 8.8
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
Fixed in
1.6.9
What to do
Update the plugin to 1.6.9 or newer.
Full record and what to do →NVD record github.com wpscan.com
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24834 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of custom label parameters - vote button label , results link label and back to vote caption label.
Product
YOP Poll
Fixed in
6.3.1
What to do
Update YOP Poll to 6.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.
Product
YOP Poll
Fixed in
6.3.1
What to do
Update YOP Poll to 6.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 15, 2021plugins/wordpress_sso/pages/index.php: ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site ScriptingCVE-2021-41951 · WordPress plugins & themes · reported by MITREMedium 6.1
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.
Product
plugins/wordpress_sso/pages/index.php
Fixed in
9.6
What to do
Update plugins/wordpress_sso/pages/index.php to 9.6 or newer.
Full record and what to do →NVD record horizon3.ai horizon3.ai
Nov 1, 2021WPeMatico RSS Feed Fetcher: Does not escape the Feed URL added to a campaign before outputting it in an attributeCVE-2021-24793 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.6.12
What to do
Update WPeMatico RSS Feed Fetcher to 2.6.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Accept Donations with PayPal: Offers a function to create donation buttonsCVE-2021-24570 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.
Product
Accept Donations with PayPal
Fixed in
1.3.1
What to do
Update Accept Donations with PayPal to 1.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 18, 2021Easy Twitter Feed: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24413 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Product
Easy Twitter Feed
Fixed in
1.2
What to do
Update Easy Twitter Feed to 1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX aCVE-2021-39317 · WordPress plugins & themes · reported by WordfenceHigh 8.8
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.
Product
affected products. The complete list of affected products and their versions are below:
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update affected products. The complete list of affected products and their versions are below: to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
Oct 11, 2021Weather Effect: Does not properly validate and escape some of its settings (like *_size_leafCVE-2021-24709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which could lead to Stored Cross-Site Scripting issues
Product
Weather Effect
Fixed in
1.3.6
What to do
Update Weather Effect to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Weather Effect: Does not have any CSRF checks in placeCVE-2021-24683 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.
Product
Weather Effect
Fixed in
1.3.4
What to do
Update Weather Effect to 1.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021WordPress uListing: Authenticated Insecure Direct Object References (IDOR)CVE-2021-36874 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).
Product
WordPress uListing
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update WordPress uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 20, 2021fetch_product_ajax functionality in the Product Feed on WooCommerce: Uses a `product_id` POST parameterCVE-2021-24511 · WordPress plugins & themes · reported by WPScanHigh 7.2
The fetch_product_ajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a `product_id` POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
fetch_product_ajax functionality in the Product Feed on WooCommerce
Fixed in
3.3.1.0
What to do
Update fetch_product_ajax functionality in the Product Feed on WooCommerce to 3.3.1.0 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 20, 2021edit functionality in the MicroCopy: Makes a get request to fetch the related optionCVE-2021-24397 · WordPress plugins & themes · reported by WPScanHigh 7.2
The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
edit functionality in the MicroCopy
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update edit functionality in the MicroCopy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 13, 2021Smash Balloon Social Post Feed: Does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of iCVE-2021-24508 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
Product
Smash Balloon Social Post Feed
Fixed in
2.19.2
What to do
Update Smash Balloon Social Post Feed to 2.19.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.