Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,619 results · page 288 of 313
Mar 7, 2022YOP Poll: Does not sanitise and escape some of the settings (available to users with a roleCVE-2022-0205 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue
- Product
- YOP Poll
- Fixed in
- 6.3.5
- What to do
- Update YOP Poll to 6.3.5 or newer.
Mar 7, 2022WordPress Multisite User Sync/Unsync: Does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributesCVE-2021-25038 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- WordPress Multisite User Sync/Unsync
- Fixed in
- 2.1.2
- What to do
- Update WordPress Multisite User Sync/Unsync to 2.1.2 or newer.
Mar 7, 2022Advanced iFrame: Does not sanitise and escape the ai_config_id parameter before outputting it back in an admin pageCVE-2021-24953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- Advanced iFrame
- Fixed in
- 2022
- What to do
- Update Advanced iFrame to 2022 or newer.
Mar 7, 2022Custom Content Shortcode: Does not escape custom fields before outputting themCVE-2021-24826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)
- Product
- Custom Content Shortcode
- Fixed in
- 4.0.2
- What to do
- Update Custom Content Shortcode to 4.0.2 or newer.
Mar 7, 2022WP Event Manager: Does not escape some of its Field Editor settingsCVE-2021-24810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- WP Event Manager
- Fixed in
- 3.1.23
- What to do
- Update WP Event Manager to 3.1.23 or newer.
Feb 28, 2022Testimonial: Does not sanitise and escape the id parameter before outputting it back in an attributeCVE-2022-23912 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting
- Product
- Testimonial
- Fixed in
- 1.4.7
- What to do
- Update Testimonial to 1.4.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022WP RSS Aggregator: Does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the responseCVE-2022-0189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- WP RSS Aggregator
- Fixed in
- 4.20
- What to do
- Update WP RSS Aggregator to 4.20 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022WP Accessibility Helper (WAH): Does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the pageCVE-2022-0150 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue
- Product
- WP Accessibility Helper (WAH)
- Fixed in
- 0.6.0.7
- What to do
- Update WP Accessibility Helper (WAH) to 0.6.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022WP-Paginate: Does not sanitise and escape its preset settingsCVE-2021-4222 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP-Paginate
- Fixed in
- 2.1.4
- What to do
- Update WP-Paginate to 2.1.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Feb 28, 2022WHMCS Bridge: Does not sanitise and escape the error parameter before outputting it back in admin dashboardCVE-2021-25112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- WHMCS Bridge
- Fixed in
- 6.4b
- What to do
- Update WHMCS Bridge to 6.4b or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Dynamic Widgets: Does not escape the prefix parameter before outputting it back in an attributeCVE-2021-24933 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting issue
- Product
- Dynamic Widgets
- Affected
- up to 1.5.16
- What to do
- Affects up to 1.5.16. Update Dynamic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022StatCounter: Does not sanitise and escape the Project ID and Secure Code settingsCVE-2021-24920 · WordPress plugins & themes · reported by WPScanMedium 4.8
The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- StatCounter
- Fixed in
- 2.0.7
- What to do
- Update StatCounter to 2.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022GRAND FlaGallery: Does not sanitise and escape some of its gallery settingsCVE-2021-24903 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privilege users to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- GRAND FlaGallery
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update GRAND FlaGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022Security Audit: Does not sanitise and escape the Data Id settingCVE-2021-24901 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Security Audit
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Security Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022Core Tweaks WP Setup: Allows to bulk-set many settings in WordPressCVE-2021-24803 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks
- Product
- Core Tweaks WP Setup
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Core Tweaks WP Setup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 202215Zine: Does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX actionCVE-2020-36510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- 15Zine
- Fixed in
- 3.3.0
- What to do
- Update 15Zine to 3.3.0 or newer.
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25307 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25306 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25305 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Feb 24, 2022Header Footer Code Manager plugin <= 1.1.16: Reflected Cross-Site Scripting (XSS)CVE-2022-0710 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter.
- Product
- Header Footer Code Manager plugin <= 1.1.16
- Affected
- up to 1.1.16
- What to do
- Affects up to 1.1.16. Update Header Footer Code Manager plugin <= 1.1.16 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 24, 2022Essential Addons for Elementor Lite: Cross-Site ScriptingCVE-2022-0683 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the ~/includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 5.0.8.
- Product
- Essential Addons for Elementor Lite
- Affected
- up to 5.0.8
- What to do
- Affects up to 5.0.8. Update Essential Addons for Elementor Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (veCVE-2022-23983 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 21, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).CVE-2021-26256 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 21, 2022Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro: Do not sanitise and escape the html_element_selection parameter before outputting it back in the pageCVE-2022-0288 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro
- Fixed in
- 2.7.10
- What to do
- Update Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro to 2.7.10 or newer.
Feb 21, 2022GiveWP: Does not escape the json parameter before outputting it back in an attribute in the Import admin dashboardCVE-2022-0252 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022WOOCS: Does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the respCVE-2022-0234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- WOOCS
- Fixed in
- 1.3.7.5
- What to do
- Update WOOCS to 1.3.7.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the POST data before outputting it back in attributes of an admin pageCVE-2021-25101 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
- Product
- Anti-Malware Security and Brute-Force Firewall
- Fixed in
- 4.20.94
- What to do
- Update Anti-Malware Security and Brute-Force Firewall to 4.20.94 or newer.
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022GiveWP: Does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX actionCVE-2021-25099 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
- Product
- Buffer Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
- Product
- Translation Exchange
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.CVE-2021-25055 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
- Product
- FeedWordPress
- Fixed in
- 2022.0123
- What to do
- Update FeedWordPress to 2022.0123 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Advanced Database Cleaner: Does not sanitise and escape $_GET keys and values before outputting them back in attributesCVE-2021-24921 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Advanced Database Cleaner
- Fixed in
- 3.0.4
- What to do
- Update Advanced Database Cleaner to 3.0.4 or newer.
Feb 14, 2022SpiderCalendar: Does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0212 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
- Product
- SpiderCalendar
- Affected
- up to 1.5.65
- What to do
- Affects up to 1.5.65. Update SpiderCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2022MapPress Maps for: Does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error messageCVE-2022-0208 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
- Product
- MapPress Maps for
- Fixed in
- 2.73.4
- What to do
- Update MapPress Maps for to 2.73.4 or newer.
Feb 14, 2022NewStatPress: Does not properly escape the whatX parameters before outputting them back in attributesCVE-2022-0206 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- NewStatPress
- Fixed in
- 1.3.6
- What to do
- Update NewStatPress to 1.3.6 or newer.
Feb 14, 2022Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themiCVE-2022-0200 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- Fixed in
- 1.1.7
- What to do
- Update the plugin to 1.1.7 or newer.
Feb 14, 2022Complianz: Does not escape the s parameter before outputting it back in an attribute in an admin pageCVE-2022-0193 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Complianz
- Fixed in
- 6.0.0
- What to do
- Update Complianz to 6.0.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022PowerPack Lite for Beaver Builder: Does not sanitise and escape the tab parameter before outputting it back in an admin pageCVE-2022-0176 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- PowerPack Lite for Beaver Builder
- Fixed in
- 1.2.9.3
- What to do
- Update PowerPack Lite for Beaver Builder to 1.2.9.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022WP Photo Album Plus: Was vulnerable to Stored Cross-Site Scripting (XSS)CVE-2021-25115 · WordPress plugins & themes · reported by WPScanMedium 6.4
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
- Product
- WP Photo Album Plus
- Fixed in
- 8.0.10
- What to do
- Update WP Photo Album Plus to 8.0.10 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022Form Store to DB: Does not sanitise and escape parameter keys before outputting it back in the created entryCVE-2021-25107 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
- Product
- Form Store to DB
- Fixed in
- 1.1.1
- What to do
- Update Form Store to DB to 1.1.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022Remove Footer Credit: Does properly sanitise its settingsCVE-2021-25050 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Remove Footer Credit
- Fixed in
- 1.0.11
- What to do
- Update Remove Footer Credit to 1.0.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022WordPress Newsletter: Does not validate the to parameter before redirecting the user to its given valueCVE-2021-25033 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
- Product
- WordPress Newsletter
- Fixed in
- 1.6.5
- What to do
- Update WordPress Newsletter to 1.6.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022PPOM for WooCommerce: Does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX actionCVE-2021-25018 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
- Product
- PPOM for WooCommerce
- Fixed in
- 24.0
- What to do
- Update PPOM for WooCommerce to 24.0 or newer.
Feb 14, 2022Ibtana: Does not have authorisation and CSRF checks in the ive_save_general_settings AJAX actionCVE-2021-25014 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.
- Product
- Ibtana
- Fixed in
- 1.1.4.9
- What to do
- Update Ibtana to 1.1.4.9 or newer.
Feb 14, 2022Mortgage Calculators WP: Does not implement any sanitisation on the color setting of the background of a calculatorCVE-2021-24904 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Mortgage Calculators WP
- Fixed in
- 1.56
- What to do
- Update Mortgage Calculators WP to 1.56 or newer.
Feb 14, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the lang and pid parameter before outputting them back in attributesCVE-2021-24874 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.31
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.31 or newer.
Feb 7, 2022WooCommerce Stored Exporter: Was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin pageCVE-2022-0149 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
- Product
- WooCommerce Stored Exporter
- Fixed in
- 2.7.1
- What to do
- Update WooCommerce Stored Exporter to 2.7.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs: Was vulnerable to reflected XSS on the my-sticky-elements-leads admin pageCVE-2022-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
- Product
- All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs
- Fixed in
- 2.0.4
- What to do
- Update All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs to 2.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.