Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

573new WordPress flaws this week

398,071entries in the database

15,625 results · page 291 of 313

Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
Modern Events Calendar Lite
Fixed in
6.1.5
What to do
Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Caldera Forms: Does not sanitise and escape the Form Name before outputting it in attributesCVE-2021-24896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Caldera Forms
Fixed in
1.9.5
What to do
Update Caldera Forms to 1.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Get Custom Field Values: Does not escape custom fields before outputting them in the pageCVE-2021-24871 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
Get Custom Field Values
Fixed in
4.0.1
What to do
Update Get Custom Field Values to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 10, 2021Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or CVE-2021-36911 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 6, 2021The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcCVE-2021-25041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action
Product
Photo Gallery by 10Web
Fixed in
1.5.68
What to do
Update Photo Gallery by 10Web to 1.5.68 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021LoginWP (Formerly Peter's Login Redirect): Does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin pageCVE-2021-24939 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
LoginWP (Formerly Peter's Login Redirect)
Fixed in
3.0.0.5
What to do
Update LoginWP (Formerly Peter's Login Redirect) to 3.0.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WOOCS: Does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24938 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue
Product
WOOCS
Fixed in
1.3.7.1
What to do
Update WOOCS to 1.3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WP Google Fonts: Does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributesCVE-2021-24935 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues
Product
WP Google Fonts
Fixed in
3.1.5
What to do
Update WP Google Fonts to 3.1.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021WordPress Online Booking and Scheduling: Does not escape the Staff Full Name field before outputting it back in a pageCVE-2021-24930 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue
Product
WordPress Online Booking and Scheduling
Fixed in
20.3.1
What to do
Update WordPress Online Booking and Scheduling to 20.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021Email Log: Does not escape the d parameter before outputting it back in an attribute in the Log pageCVE-2021-24924 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue
Product
Email Log
Fixed in
2.4.8
What to do
Update Email Log to 2.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021Contact Form, Survey & Popup Form Plugin for: Does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-24718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Contact Form, Survey & Popup Form Plugin for
Fixed in
1.5
What to do
Update Contact Form, Survey & Popup Form Plugin for to 1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021Import any XML or CSV File to: Does not escape the Import's Title and Unique Identifier fields before outputting them in admin pagesCVE-2021-24714 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.
Product
Import any XML or CSV File to
Fixed in
3.6.3
What to do
Update Import any XML or CSV File to to 3.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 2, 2021ClickBank Affiliate Ads: Does not escape its settingsCVE-2015-20106 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
ClickBank Affiliate Ads
Affected
up to 1.20
What to do
Affects up to 1.20. Update ClickBank Affiliate Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 1, 2021Events Manager: Does not sanitise and escape some search parameter before outputing them in pagesCVE-2020-35037 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues
Product
Events Manager
Fixed in
5.9.8
What to do
Update Events Manager to 5.9.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 30, 2021Browser and Operating System Finder versions prior to 1.2: Cross-site request forgery (CSRF)CVE-2021-20851 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.
Product
Browser and Operating System Finder versions prior to 1.2
Fixed in
1.2
What to do
Update Browser and Operating System Finder versions prior to 1.2 to 1.2 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Nov 29, 2021Asgaros Forums: Stored Cross-Site ScriptingCVE-2021-42365 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Asgaros Forums
Affected
up to 1.15.13
What to do
Affects up to 1.15.13. Update Asgaros Forums to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2021My Calendar: Does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24927 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
My Calendar
Fixed in
3.2.18
What to do
Update My Calendar to 3.2.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Smash Balloon Social Post Feed: Did not have any privilege or nonce validation before saving the plugin's settingCVE-2021-24918 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
Product
Smash Balloon Social Post Feed
Fixed in
4.0.1
What to do
Update Smash Balloon Social Post Feed to 4.0.1 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Nov 29, 2021Check & Log Email: Does not escape the d parameter before outputting it back in an attributeCVE-2021-24908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Check & Log Email
Fixed in
1.0.4
What to do
Update Check & Log Email to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Media-Tags: Does not sanitise and escape any of its Labels settingsCVE-2021-24899 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Media-Tags WordPress plugin through 3.2.0.2 does not sanitise and escape any of its Labels settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_htnl capability is disallowed.
Product
Media-Tags
Affected
up to 3.2.0.2
What to do
Affects up to 3.2.0.2. Update Media-Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Registrations for the Events Calendar: Does not escape the v parameter before outputting it back in an attributeCVE-2021-24876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Registrations for the Events Calendar
Fixed in
2.7.5
What to do
Update Registrations for the Events Calendar to 2.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021About Author Box: Does not sanitise and escape the Social Profiles field values before outputting them in attributesCVE-2021-24745 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
About Author Box
Fixed in
1.0.2
What to do
Update About Author Box to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021myCred: Does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboardCVE-2017-20008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting
Product
myCred
Fixed in
1.7.8
What to do
Update myCred to 1.7.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 26, 2021Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id,CVE-2021-36919 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 26, 2021Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media ConfiguCVE-2021-36843 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
Affected
up to 4.3.5
What to do
Affects up to 4.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 24, 2021Booking Package - Appointment Booking Calendar System versions prior to 1.5.11: Cross-site scriptingCVE-2021-20840 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Product
Booking Package - Appointment Booking Calendar System versions prior to 1.5.11
Fixed in
1.5.11
What to do
Update Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 to 1.5.11 or newer.
Full record and what to do →NVD record jvn.jp saasproject.net
Nov 23, 2021Reviews Plus: Does not validate the submitted ratingCVE-2021-24894 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page
Product
Reviews Plus
Fixed in
1.2.14
What to do
Update Reviews Plus to 1.2.14 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 23, 2021ImageBoss: Does not sanitise and escape its Source Name settingCVE-2021-24888 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks
Product
ImageBoss
Fixed in
3.0.6
What to do
Update ImageBoss to 3.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021eCommerce Product Catalog Plugin for: Does not escape the ic-settings-search parameter before outputting it back in the page in an attributeCVE-2021-24875 · WordPress plugins & themes · reported by WPScanMedium 6.1
The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
eCommerce Product Catalog Plugin for
Fixed in
3.0.39
What to do
Update eCommerce Product Catalog Plugin for to 3.0.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021Tutor LMS: Does not sanitise and escape user input before outputting back in attributes in the Student Registration pageCVE-2021-24873 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
Product
Tutor LMS
Fixed in
1.9.11
What to do
Update Tutor LMS to 1.9.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 23, 2021Advanced Access Manager: Does not escape some of its settingsCVE-2021-24830 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Advanced Access Manager
Fixed in
6.8.0
What to do
Update Advanced Access Manager to 6.8.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 23, 2021Logo Showcase with Slick Slider: Does not sanitise the Grid SettingsCVE-2021-24729 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase.
Product
Logo Showcase with Slick Slider
Fixed in
1.2.4
What to do
Update Logo Showcase with Slick Slider to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 19, 2021Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.CVE-2021-36884 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 19, 2021The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (aCVE-2021-43409 · WordPress plugins & themes · reported by info@appcheck-ng.comCritical 9.3
The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data. In this case, the XSS payload can be submitted by any anonymous user, the payload then renders and executes when a WordPress administrator authenticates and accesses the WordPress Dashboard. The injected payload can carry out actions on behalf of the administrator including adding other administrative users and changing application settings. This flaw could be exploited to ultimately provide full control of the affected system to the attacker.
Affected
up to 15.3
What to do
Affects up to 15.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record appcheck-ng.com wpo365.com
Nov 19, 2021Preview E-Mails for WooCommerce: Reflected Cross-Site ScriptingCVE-2021-42363 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8.
Product
Preview E-Mails for WooCommerce
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Preview E-Mails for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 17, 2021Contact Form Email: Stored Cross-Site ScriptingCVE-2021-42361 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Contact Form Email
Affected
up to 1.3.24
What to do
Affects up to 1.3.24. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 17, 2021Shared Files: Does not sanitise and escape the Download Counter Text settingsCVE-2021-24856 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Shared Files
Fixed in
1.6.61
What to do
Update Shared Files to 1.6.61 or newer.
Full record and what to do →NVD record mikadmin.fr wpscan.com
Nov 17, 2021MouseWheel Smooth Scroll: Does not have CSRF check in place on its settings pageCVE-2021-24852 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
MouseWheel Smooth Scroll
Fixed in
5.7
What to do
Update MouseWheel Smooth Scroll to 5.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021Helpful: Does not sanitise and escape some of its settingsCVE-2021-24841 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Helpful
Fixed in
4.4.59
What to do
Update Helpful to 4.4.59 or newer.
Full record and what to do →NVD record mikadmin.fr wpscan.com
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24834 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of custom label parameters - vote button label , results link label and back to vote caption label.
Product
YOP Poll
Fixed in
6.3.1
What to do
Update YOP Poll to 6.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.
Product
YOP Poll
Fixed in
6.3.1
What to do
Update YOP Poll to 6.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
Product
My Tickets
Fixed in
1.8.31
What to do
Update My Tickets to 1.8.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021Client Invoicing by Sprout Invoices: Does not sanitise and escape some of its settingsCVE-2021-24787 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Client Invoicing by Sprout Invoices
Fixed in
19.9.7
What to do
Update Client Invoicing by Sprout Invoices to 19.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 15, 2021plugins/wordpress_sso/pages/index.php: ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site ScriptingCVE-2021-41951 · WordPress plugins & themes · reported by MITREMedium 6.1
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.
Product
plugins/wordpress_sso/pages/index.php
Fixed in
9.6
What to do
Update plugins/wordpress_sso/pages/index.php to 9.6 or newer.
Full record and what to do →NVD record horizon3.ai horizon3.ai
Nov 8, 2021The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with aCVE-2021-24835 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks
Product
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Fixed in
6.5.12
What to do
Update WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible to 6.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Support Board: Allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes fieldCVE-2021-24807 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
Product
Support Board
Fixed in
3.3.5
What to do
Update Support Board to 3.3.5 or newer.
Full record and what to do →NVD record github.com medium.com
Nov 8, 2021WP Header Images: Does not sanitise and escape the t parameter before outputting it back in the plugin's settings pageCVE-2021-24798 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page, leading to a Reflected Cross-Site Scripting issue
Product
WP Header Images
Fixed in
2.0.1
What to do
Update WP Header Images to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Print-O-Matic: Does not escape some of its settings before outputting them in attributeCVE-2021-24710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Print-O-Matic
Fixed in
2.0.3
What to do
Update Print-O-Matic to 2.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Export any WordPress data to XML/CSV: Does not escape its Export's Name before outputting it in Manage Exports settingsCVE-2021-24708 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Export any WordPress data to XML/CSV
Fixed in
1.3.1
What to do
Update Export any WordPress data to XML/CSV to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Qwizcards – online quizzes and flashcards: Does not properly sanitize and escape some of its settingsCVE-2021-24706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Qwizcards – online quizzes and flashcards
Fixed in
3.62
What to do
Update Qwizcards – online quizzes and flashcards to 3.62 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.