Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

548new WordPress flaws this week

397,870entries in the database

15,619 results · page 287 of 313

Mar 25, 2022Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malCVE-2022-25611 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][].
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 25, 2022Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code.CVE-2022-25610 · WordPress plugins & themes · reported by PatchstackLow 3.4
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.
Affected
up to 20220115
What to do
Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 25, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25606 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.
Affected
up to 1.68.6
What to do
Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 23, 2022Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to injectCVE-2022-25609 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 23, 2022Ninja Forms - File Uploads Extension: Reflected cross-site scriptingCVE-2022-0889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
Product
Ninja Forms - File Uploads Extension
Affected
up to 3.3.12
What to do
Affects up to 3.3.12. Update Ninja Forms - File Uploads Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ninjaforms.com wordfence.com
Mar 23, 2022Amelia: Cross-Site ScriptingCVE-2022-0834 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user accesses the booking calendar with the date the attacker has injected the malicious payload into. This affects versions up to and including 1.0.46.
Product
Amelia
Affected
up to 1.0.46
What to do
Affects up to 1.0.46. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 23, 2022Photoswipe Masonry Gallery: Cross-Site ScriptingCVE-2022-0750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
Product
Photoswipe Masonry Gallery
Affected
up to 1.2.14
What to do
Affects up to 1.2.14. Update Photoswipe Masonry Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 21, 2022Pricing Table Builder: Does not sanitize and escape the postid parameter before outputting it back in an admin pageCVE-2022-0640 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Pricing Table Builder
Fixed in
1.1.5
What to do
Update Pricing Table Builder to 1.1.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022Mega Menu: Does not sanitize and escape the _wpnonce parameter before outputting it back in an admin pageCVE-2022-0628 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Mega Menu
Fixed in
3.0.8
What to do
Update Mega Menu to 3.0.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022Amelia: Does not sanitize and escape the code parameter before outputting it back in an admin pageCVE-2022-0627 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Amelia
Fixed in
1.0.47
What to do
Update Amelia to 1.0.47 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2022BulletProof Security: Does not sanitise and escape some of its settingsCVE-2022-0590 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
BulletProof Security
Fixed in
5.8
What to do
Update BulletProof Security to 5.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2022SEO Plugin by Squirrly SEO: Does not escape the type parameter before outputting it back in an attribute in an admin pageCVE-2021-25019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
SEO Plugin by Squirrly SEO
Fixed in
11.1.12
What to do
Update SEO Plugin by Squirrly SEO to 11.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25605 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.
Affected
up to 1.68.6
What to do
Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2).CVE-2022-25604 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2).
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).CVE-2022-25603 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).
Affected
6.2.5 to 6.2.5
What to do
Affects 6.2.5 to 6.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versionsCVE-2022-25602 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress pluCVE-2021-23209 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress plugin (versions <= 1.0.77.32).
Affected
up to 1.0.77.32
What to do
Affects up to 1.0.77.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.CVE-2021-23150 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.
Affected
up to 1.0.77.31
What to do
Affects up to 1.0.77.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 14, 2022GD Mylist: Does not sanitise and escape some of its settingsCVE-2022-0703 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
GD Mylist
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update GD Mylist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Petfinder Listings: Does not escape its settingsCVE-2022-0702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Petfinder Listings
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update Petfinder Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022SEO 301 Meta: Does not escape its Request and Destination settingsCVE-2022-0701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
SEO 301 Meta
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update SEO 301 Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Simple Tracking: Does not sanitise and escape its settingsCVE-2022-0700 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Simple Tracking
Fixed in
1.7
What to do
Update Simple Tracking to 1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022WP Home Page Menu: Does not sanitise and escape its settingsCVE-2022-0684 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
WP Home Page Menu
Fixed in
3.1
What to do
Update WP Home Page Menu to 3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022Kunze Law: Does not escape its 'E-Mail Error "From" Address' settingsCVE-2022-0674 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Kunze Law
Fixed in
2.1
What to do
Update Kunze Law to 2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Sync QCloud COS: Does not escape some of its settingsCVE-2022-0659 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Sync QCloud COS
Fixed in
2.0.1
What to do
Update Sync QCloud COS to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Team Circle Image Slider With Lightbox: Does not sanitize and escape the order_pos parameter before outputting it back in an admin pageCVE-2022-0648 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Team Circle Image Slider With Lightbox
Fixed in
1.0.16
What to do
Update Team Circle Image Slider With Lightbox to 1.0.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Countdown, Coming Soon, Maintenance: Does not sanitize and escape the post parameter before outputting it back in an admin pageCVE-2022-0601 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Countdown, Coming Soon, Maintenance
Fixed in
2.2.9
What to do
Update Countdown, Coming Soon, Maintenance to 2.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022WordPress Multisite Content Copier/Updater: Does not sanitise and escape the s parameter before outputting it back in an attributeCVE-2022-0503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in the network dashboard
Product
WordPress Multisite Content Copier/Updater
Fixed in
2.1.2
What to do
Update WordPress Multisite Content Copier/Updater to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Flexi: Does not sanitise and escape various parameters before outputting them back in some pages suchCVE-2022-0449 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting
Product
Flexi
Fixed in
4.20
What to do
Update Flexi to 4.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Advanced Product Labels for WooCommerce: Does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's responseCVE-2022-0399 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting
Product
Advanced Product Labels for WooCommerce
Fixed in
1.2.3.7
What to do
Update Advanced Product Labels for WooCommerce to 1.2.3.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022Master Addons for Elementor: Does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX actionCVE-2022-0327 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting
Product
Master Addons for Elementor
Fixed in
1.8.5
What to do
Update Master Addons for Elementor to 1.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022WP Voting Contest: Does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Product
WP Voting Contest
Fixed in
3.0
What to do
Update WP Voting Contest to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
Product
Contact Form Submissions
Fixed in
1.7.3
What to do
Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX actCVE-2022-0165 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
Product
Page Builder KingComposer
Affected
up to 2.9.6
What to do
Affects up to 2.9.6. Update Page Builder KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022ARI Fancy Lightbox: Does not sanitise and escape the msg parameter before outputting it back in an admin pageCVE-2022-0161 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
ARI Fancy Lightbox
Fixed in
1.3.9
What to do
Update ARI Fancy Lightbox to 1.3.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Cookie Information | Free GDPR Consent Solution
Fixed in
2.0.8
What to do
Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022MOLIE: Does not escape the course_id parameter before outputting it back in the admin dashboardCVE-2021-25006 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
MOLIE
Affected
up to 0.5
What to do
Affects up to 0.5. Update MOLIE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leadingCVE-2021-24996 · WordPress plugins & themes · reported by WPScanMedium 6.1
The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting
Product
IDPay for Contact Form 7
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update IDPay for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022HTML5 Responsive FAQ: Does not properly sanitise and escape some of its settingsCVE-2021-24995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
HTML5 Responsive FAQ
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update HTML5 Responsive FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Child Theme Generator: Does not sanitise escape the parade parameter before outputting it backCVE-2021-24982 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Child Theme Generator WordPress plugin through 2.2.7 does not sanitise escape the parade parameter before outputting it back, leading to a Reflected Cross-Site Scripting in the admin dashboard
Product
Child Theme Generator
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Child Theme Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Persian Woocommerce: Does not escape the s parameter before outputting it back in an attribute in the admin dashboardCVE-2021-24940 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue
Product
Persian Woocommerce
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update Persian Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Cybersoldier: Does not sanitise and escape the URL settings before outputting it in an attributeCVE-2021-24895 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Cybersoldier
Fixed in
1.7.0
What to do
Update Cybersoldier to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2022Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).CVE-2022-25601 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
Affected
up to 2.4
What to do
Affects up to 2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Mar 11, 2022Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3)CVE-2022-25600 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Mar 7, 2022E2Pdf: Does not sanitise and escape some of its settingsCVE-2022-0535 · WordPress plugins & themes · reported by WPScanMedium 4.8
The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
E2Pdf
Fixed in
1.16.45
What to do
Update E2Pdf to 1.16.45 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022Ditty (formerly Ditty News Ticker): Is affected by a Reflected Cross-Site Scripting (XSS) vulnerabilityCVE-2022-0533 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
Product
Ditty (formerly Ditty News Ticker)
Fixed in
3.0.15
What to do
Update Ditty (formerly Ditty News Ticker) to 3.0.15 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022CP Blocks: Does not sanitise and escape its "License ID" settingsCVE-2022-0448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
CP Blocks
Fixed in
1.0.15
What to do
Update CP Blocks to 1.0.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022Product Feed PRO for WooCommerce: Does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user)CVE-2022-0426 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Product
Product Feed PRO for WooCommerce
Fixed in
11.2.3
What to do
Update Product Feed PRO for WooCommerce to 11.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022White Label CMS: Does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewingCVE-2022-0422 · WordPress plugins & themes · reported by WPScanMedium 6.1
The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue
Product
White Label CMS
Fixed in
2.2.9
What to do
Update White Label CMS to 2.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022LoginPress | Custom Login Page Customizer: Does not escape the redirect-page parameter before outputting it back in an attributeCVE-2022-0347 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
LoginPress | Custom Login Page Customizer
Fixed in
1.5.12
What to do
Update LoginPress | Custom Login Page Customizer to 1.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.