Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,625 results · page 298 of 313
Apr 22, 2021Cooked Pro: Was affected by unauthenticated reflected Cross-Site Scripting issuesCVE-2021-24233 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
- Product
- Cooked Pro
- Fixed in
- 1.7.5.6
- What to do
- Update Cooked Pro to 1.7.5.6 or newer.
Full record and what to do →NVD recordwpscan.comgetastra.com
Apr 12, 2021The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin befoCVE-2021-24229 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
- Fixed in
- 1.7.2
- What to do
- Update the plugin to 1.7.2 or newer.
Apr 12, 2021Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon: The WordPress login form (wp-loginCVE-2021-24228 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized.
- Product
- Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon
- Fixed in
- 1.7.2
- What to do
- Update Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon to 1.7.2 or newer.
Apr 12, 2021Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon: That could be abused by anyone visiting the siteCVE-2021-24227 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
- Product
- Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon
- Fixed in
- 1.7.0
- What to do
- Update Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon to 1.7.0 or newer.
Apr 12, 2021Advanced Booking Calendar: Did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tagCVE-2021-24225 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue
- Product
- Advanced Booking Calendar
- Fixed in
- 1.6.7
- What to do
- Update Advanced Booking Calendar to 1.6.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 12, 2021wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for: Were vulnerable to CSRF due to a lack of nonce protectionCVE-2021-24218 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.
- Product
- wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for
- Fixed in
- 3.0.4
- What to do
- Update wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for to 3.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 12, 2021run_action function of the Facebook for: Deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerabilityCVE-2021-24217 · WordPress plugins & themes · reported by WPScanHigh 8.1
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
- Product
- run_action function of the Facebook for
- Fixed in
- 3.0.0
- What to do
- Update run_action function of the Facebook for to 3.0.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 12, 2021GiveWP – Donation Plugin and Fundraising Platform: Was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panelCVE-2021-24213 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.0
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.0 or newer.
Apr 9, 2021the Larsens Calender plugin Version <= 1.2 for: Cross Site Scripting (XSS)CVE-2020-23762 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote attackers to execute arbitrary web script via the "titel" column on the "Eintrage hinzufugen" tab.
- Product
- the Larsens Calender plugin Version <= 1.2 for
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the Larsens Calender plugin Version <= 1.2 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhidden-one.co.inwordpress.org
Apr 5, 2021The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page.CVE-2021-24211 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.
- Product
- WordPress Related Posts
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update WordPress Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021WP Super Cache: Was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location optionCVE-2021-24209 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
- Product
- WP Super Cache
- Fixed in
- 1.7.2
- What to do
- Update WP Super Cache to 1.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 5, 2021Social Slider Widget: Allowed Authenticated Reflected XSS in the plugin settings pageCVE-2021-24196 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
- Product
- Social Slider Widget
- Fixed in
- 1.8.5
- What to do
- Update Social Slider Widget to 1.8.5 or newer.
Full record and what to do →NVD recordpurinechu.github.iowpscan.com
Apr 5, 2021setting page of the SEO Redirection Plugin - 301 Redirect Manager: Is vulnerable to reflected Cross-Site Scripting (XSS)CVE-2021-24187 · WordPress plugins & themes · reported by WPScanMedium 5.4
The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute.
- Product
- setting page of the SEO Redirection Plugin - 301 Redirect Manager
- Fixed in
- 6.4
- What to do
- Update setting page of the SEO Redirection Plugin - 301 Redirect Manager to 6.4 or newer.
Apr 5, 2021tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24185 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
- Product
- tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution
- Fixed in
- 1.7.7
- What to do
- Update tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerabCVE-2021-24180 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.
- Fixed in
- 2.0.4
- What to do
- Update the plugin to 2.0.4 or newer.
Apr 5, 2021When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wtsCVE-2021-24167 · WordPress plugins & themes · reported by WPScanHigh 7.5
When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookup_WP_account.
- Fixed in
- 1.4.1
- What to do
- Update the plugin to 1.4.1 or newer.
Apr 5, 2021In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings.CVE-2021-24162 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.
- Fixed in
- 4.0.4
- What to do
- Update the plugin to 4.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML wiCVE-2021-24156 · WordPress plugins & themes · reported by WPScanMedium 5.4
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation
- Affected
- 3.0.3 to 3.0.3
- What to do
- Affects 3.0.3 to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blackCVE-2021-24153 · WordPress plugins & themes · reported by WPScanMedium 5.4
A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.
- Product
- Yoast SEO
- Fixed in
- 3.4.1
- What to do
- Update Yoast SEO to 3.4.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Apr 5, 2021The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.CVE-2021-24152 · WordPress plugins & themes · reported by WPScanMedium 6.1
The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.
- Fixed in
- 3.74
- What to do
- Update the plugin to 3.74 or newer.
Apr 5, 2021LikeBtn WordPress Like Button Rating ♥ LikeBtn: Was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF)CVE-2021-24150 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF).
- Product
- LikeBtn WordPress Like Button Rating ♥ LikeBtn
- Fixed in
- 2.6.32
- What to do
- Update LikeBtn WordPress Like Button Rating ♥ LikeBtn to 2.6.32 or newer.
Mar 18, 2021Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importinCVE-2021-24142 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections.
- Product
- 301 Redirects - Easy Redirect Manager
- Fixed in
- 2.51
- What to do
- Update 301 Redirects - Easy Redirect Manager to 2.51 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabCVE-2021-24136 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL
- Product
- Testimonials Widget
- Fixed in
- 4.0.0
- What to do
- Update Testimonials Widget to 4.0.0 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vCVE-2021-24135 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.
- Product
- WP Customer Reviews
- Fixed in
- 3.4.3
- What to do
- Update WP Customer Reviews to 3.4.3 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site ScriptinCVE-2021-24134 · WordPress plugins & themes · reported by WPScanMedium 4.8
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
- Product
- Constant Contact Forms
- Fixed in
- 1.8.8
- What to do
- Update Constant Contact Forms to 1.8.8 or newer.
Mar 18, 2021Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administCVE-2021-24133 · WordPress plugins & themes · reported by WPScanMedium 4.3
Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account.
- Product
- ActiveCampaign
- Fixed in
- 8.0.2
- What to do
- Update ActiveCampaign to 8.0.2 or newer.
Mar 18, 2021Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable toCVE-2021-24130 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+).
- Product
- WP Google Map
- Fixed in
- 4.1.5
- What to do
- Update WP Google Map to 4.1.5 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vCVE-2021-24129 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.
- Product
- Themify Portfolio Post
- Fixed in
- 1.1.6
- What to do
- Update Themify Portfolio Post to 1.1.6 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowingCVE-2021-24128 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker (contributor+) to inject arbitrary web script or HTML via the 'Description/biography' of a member.
- Product
- Team Members
- Fixed in
- 5.0.4
- What to do
- Update Team Members to 5.0.4 or newer.
Feb 10, 2021Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-secuCVE-2020-29171 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.
- Fixed in
- 4.4.6
- What to do
- Update the plugin to 4.4.6 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Feb 9, 2021A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modiCVE-2020-35942 · WordPress plugins & themes · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
- Product
- A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery
- Fixed in
- 3.5.0
- What to do
- Update A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery to 3.5.0 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jan 19, 2021The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugCVE-2020-28707 · WordPress plugins & themes · reported by MITREMedium 6.1
The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the "e" variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,'*') for that object.
- Product
- Stockdio Historical Chart
- Fixed in
- 2.8.1
- What to do
- Update Stockdio Historical Chart to 2.8.1 or newer.
Full record and what to do →NVD recordjondow.euwordpress.org
Jan 15, 2021Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authentCVE-2020-35748 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter.
- Product
- Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player
- Fixed in
- 7.4.37.727
- What to do
- Update Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player to 7.4.37.727 or newer.
Full record and what to do →NVD recorddocs.google.comgithub.com
Jan 6, 2021The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until tCVE-2020-36176 · WordPress plugins & themes · reported by MITREHigh 7.5
The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.
- Product
- iThemes Security (formerly Better WP Security)
- Fixed in
- 7.7.0
- What to do
- Update iThemes Security (formerly Better WP Security) to 7.7.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Dec 31, 2020Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layoutCVE-2020-35937 · WordPress plugins & themes · reported by MITREHigh 7.5
Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.
- Product
- Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase
- Fixed in
- 1.22.16
- What to do
- Update Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase to 1.22.16 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 31, 2020Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts incCVE-2020-35936 · WordPress plugins & themes · reported by MITREHigh 7.5
Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.
- Product
- Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid
- Fixed in
- 2.0.73
- What to do
- Update Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid to 2.0.73 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 31, 2020A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victimCVE-2020-35933 · WordPress plugins & themes · reported by MITREMedium 6.5
A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.
- Product
- A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter
- Fixed in
- 6.8.2
- What to do
- Update A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 25, 2020A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.CVE-2020-29172 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.
- Product
- A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache
- Fixed in
- 3.6.1
- What to do
- Update A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache to 3.6.1 or newer.
Full record and what to do →NVD recordwordpress.orglitespeedtech.com
Dec 14, 2020A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have conviCVE-2020-29304 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim is proceeding through the file import workflow.
- Fixed in
- 1.3.46
- What to do
- Update the plugin to 1.3.46 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 14, 2020A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script orCVE-2020-29303 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with _drts_form_build_id parameter containing the XSS payload and _t_ parameter set to an invalid or non-existent CSRF token.
- Product
- SabaiApp Directories Pro
- Affected
- 1.3.45 to 1.3.45
- What to do
- Affects 1.3.45 to 1.3.45. Update SabaiApp Directories Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 21, 2020Simple Download Monitor 3.8.8 and earlier: Cross-site scriptingCVE-2020-5650 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Simple Download Monitor 3.8.8 and earlier
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update Simple Download Monitor 3.8.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2020Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php.CVE-2020-26672 · WordPress plugins & themes · reported by MITREMedium 5.4
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database.
- Fixed in
- 3.0.3
- What to do
- Update the plugin to 3.0.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Sep 30, 2020There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needCVE-2020-21524 · WordPress plugins & themes · reported by MITRECritical 9.1
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423
- What to do
- Update the plugin to the newest version.
Sep 14, 2020Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php.CVE-2020-25380 · WordPress plugins & themes · reported by MITREMedium 5.4
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.
- Affected
- 0.8 to 0.8
- What to do
- Affects 0.8 to 0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Sep 14, 2020Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.CVE-2020-25378 · WordPress plugins & themes · reported by MITREMedium 6.1
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.
- Affected
- 1.3.0 to 1.3.0
- What to do
- Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Sep 14, 2020Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field,CVE-2020-25375 · WordPress plugins & themes · reported by MITREMedium 5.4
Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field, Address field, Town field, Phone field, Mobile field, Place of Birth field, Web Site field, VAT Number field, Last Name field, Fax field, Email field, and Skype field.
- Affected
- 1.8.7 to 1.8.7
- What to do
- Affects 1.8.7 to 1.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Aug 31, 2020The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.CVE-2020-20627 · WordPress plugins & themes · reported by MITREMedium 5.3
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
- Product
- includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Aug 14, 2020A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary weCVE-2019-6112 · WordPress plugins & themes · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).
- Product
- Sell Media
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Sell Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.commetamorfosec.com
Jul 21, 2020A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to injecCVE-2020-14063 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.
- Product
- A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript
- Fixed in
- 1.2.2
- What to do
- Update A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript to 1.2.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 9, 2020A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submiCVE-2020-15299 · WordPress plugins & themes · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is executed in the victim's browser.
- Product
- A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.