Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,155 results · page 35 of 44
Mar 14, 2022WP Email Users: Does not escape the data_raw parameter in the weu_selected_users_1 AJAX actionCVE-2021-24959 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.
- Product
- WP Email Users
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update WP Email Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Insight Core: Does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user)CVE-2021-24950 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user), does not validate user input before passing it to unserialize(), nor sanitise and escape it before outputting it in the response. As a result, it could allow users with a role as low as Subscriber to perform PHP Object Injection, as well as Stored Cross-Site Scripting attacks
- Product
- Insight Core
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Insight Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Simple Download Monitor: Allows users with a roleCVE-2021-24692 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector.
- Product
- Simple Download Monitor
- Fixed in
- 3.9.5
- What to do
- Update Simple Download Monitor to 3.9.5 or newer.
Mar 7, 2022UsersWP: Is missing access controlsCVE-2022-0442 · WordPress plugins & themes · reported by WPScanMedium 4.3
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
- Product
- UsersWP
- Fixed in
- 1.2.3.1
- What to do
- Update UsersWP to 1.2.3.1 or newer.
Mar 7, 2022Product Feed PRO for WooCommerce: Does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user)CVE-2022-0426 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- Product
- Product Feed PRO for WooCommerce
- Fixed in
- 11.2.3
- What to do
- Update Product Feed PRO for WooCommerce to 11.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022Video Conferencing with Zoom: Does not have authorisation in its vczapi_get_wp_users AJAX actionCVE-2022-0384 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog
- Product
- Video Conferencing with Zoom
- Fixed in
- 3.8.17
- What to do
- Update Video Conferencing with Zoom to 3.8.17 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022YOP Poll: Does not sanitise and escape some of the settings (available to users with a roleCVE-2022-0205 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue
- Product
- YOP Poll
- Fixed in
- 6.3.5
- What to do
- Update YOP Poll to 6.3.5 or newer.
Mar 7, 2022WordPress Multisite User Sync/Unsync: Does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributesCVE-2021-25038 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- WordPress Multisite User Sync/Unsync
- Fixed in
- 2.1.2
- What to do
- Update WordPress Multisite User Sync/Unsync to 2.1.2 or newer.
Mar 7, 2022WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro: Allows users with a roleCVE-2021-24960 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks
- Product
- WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro
- Fixed in
- 4.16.3
- What to do
- Update WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro to 4.16.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, toCVE-2021-24824 · WordPress plugins & themes · reported by WPScanMedium 4.3
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
- Product
- [field] shortcode included with the Custom Content Shortcode
- Fixed in
- 4.0.1
- What to do
- Update [field] shortcode included with the Custom Content Shortcode to 4.0.1 or newer.
Mar 7, 2022Cost Calculator: Allows users with a roleCVE-2021-24821 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)
- Product
- Cost Calculator
- Fixed in
- 1.6
- What to do
- Update Cost Calculator to 1.6 or newer.
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-SiCVE-2022-23987 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Fixed in
- 1.8.176
- What to do
- Update the plugin to 1.8.176 or newer.
Feb 28, 2022Asgaros Forum: Does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user)CVE-2022-0411 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection
- Product
- Asgaros Forum
- Fixed in
- 2.0.0
- What to do
- Update Asgaros Forum to 2.0.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Crazy Bone: Does not sanitise and escape the username submitted via the login fromCVE-2022-0385 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting
- Product
- Crazy Bone
- Affected
- up to 0.6.0
- What to do
- Affects up to 0.6.0. Update Crazy Bone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration.CVE-2022-0377 · WordPress plugins & themes · reported by WPScanMedium 4.3
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.
- Product
- LearnPress
- Fixed in
- 4.1.5
- What to do
- Update LearnPress to 4.1.5 or newer.
Full record and what to do →NVD recordbozogullarindan.comgithub.com
Feb 28, 2022Customize WordPress Emails and Alerts: Does not have authorisation and CSRF check in its bnfw_search_users AJAX actionCVE-2022-0345 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
- Product
- Customize WordPress Emails and Alerts
- Fixed in
- 1.8.7
- What to do
- Update Customize WordPress Emails and Alerts to 1.8.7 or newer.
Feb 28, 2022WP User: Does not sanitise and escape some parameters in pages where the [wp_user] shortcode is usedCVE-2021-25034 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues
- Product
- WP User
- Fixed in
- 7.0
- What to do
- Update WP User to 7.0 or newer.
Feb 28, 2022Cost Calculator: Allows authenticated users (Contributor+ in versions < 1CVE-2021-24820 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout
- Product
- Cost Calculator
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server CVE-2021-24689 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack
- Product
- Contact Forms - Drag & Drop Contact Form Builder
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Contact Forms - Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2022WOOCS: Does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the respCVE-2022-0234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- WOOCS
- Fixed in
- 1.3.7.5
- What to do
- Update WOOCS to 1.3.7.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
- Product
- Buffer Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2022The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).CVE-2022-23981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 17, 2022The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nCVE-2022-0633 · WordPress plugins & themes · reported by WPScanMedium 6.5
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
- Fixed in
- 1.22.3
- What to do
- Update the plugin to 1.22.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comjetpack.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts.CVE-2022-24665 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to editCVE-2022-24664 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated userCVE-2022-24663 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated user.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 14, 2022SpiderCalendar: Does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0212 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
- Product
- SpiderCalendar
- Affected
- up to 1.5.65
- What to do
- Affects up to 1.5.65. Update SpiderCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2022CMP: Allows any userCVE-2022-0188 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.
- Product
- CMP
- Fixed in
- 4.0.19
- What to do
- Update CMP to 4.0.19 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022Futurio Extra: Allows any logged in userCVE-2021-25110 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address.
- Product
- Futurio Extra
- Fixed in
- 1.6.3
- What to do
- Update Futurio Extra to 1.6.3 or newer.
Feb 14, 2022Futurio Extra: Is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the databaseCVE-2021-25109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
- Product
- Futurio Extra
- Fixed in
- 1.6.3
- What to do
- Update Futurio Extra to 1.6.3 or newer.
Feb 14, 2022WordPress Newsletter: Does not validate the to parameter before redirecting the user to its given valueCVE-2021-25033 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
- Product
- WordPress Newsletter
- Fixed in
- 1.6.5
- What to do
- Update WordPress Newsletter to 1.6.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Paid Memberships Pro: Does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statementCVE-2021-25114 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
- Product
- Paid Memberships Pro
- Fixed in
- 2.6.7
- What to do
- Update Paid Memberships Pro to 2.6.7 or newer.
Full record and what to do →NVD recordwpscan.compaidmembershipspro.com
Feb 1, 2022The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, respondsCVE-2022-0220 · WordPress plugins & themes · reported by WPScanMedium 6.1
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)
- Product
- WordPress GDPR
- Fixed in
- 1.9.27
- What to do
- Update WordPress GDPR to 1.9.27 or newer.
Feb 1, 2022Asset CleanUp: Page Speed Booster: Does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users)CVE-2021-24983 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issue
- Product
- Asset CleanUp: Page Speed Booster
- Fixed in
- 1.3.8.5
- What to do
- Update Asset CleanUp: Page Speed Booster to 1.3.8.5 or newer.
Feb 1, 2022The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, respondsCVE-2021-24814 · WordPress plugins & themes · reported by WPScanCritical 9.6
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction).
- Product
- WordPress GDPR
- Fixed in
- 1.9.26
- What to do
- Update WordPress GDPR to 1.9.26 or newer.
Jan 25, 2022The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create, edit,CVE-2021-45729 · WordPress plugins & themes · reported by PatchstackMedium 5.4
The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create, edit, and delete maps.
- Product
- WP Google Map
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update WP Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jan 24, 2022WP User Frontend: Does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboardCVE-2021-25076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
- Product
- WP User Frontend
- Fixed in
- 3.5.26
- What to do
- Update WP User Frontend to 3.5.26 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Jan 24, 2022Event Tickets: Does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given valueCVE-2021-25028 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
- Product
- Event Tickets
- Fixed in
- 5.2.2
- What to do
- Update Event Tickets to 5.2.2 or newer.
Jan 24, 2022WP Post Page Clone: Allows users with a roleCVE-2021-24733 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and password-protected posts which they cannot view normally.
- Product
- WP Post Page Clone
- Fixed in
- 1.2
- What to do
- Update WP Post Page Clone to 1.2 or newer.
Jan 24, 2022Simple Download Monitor: Could allow users with a roleCVE-2021-24694 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1) "color" or "css_class" argument of sdm_download shortcode, 2) "class" or "placeholder" argument of sdm_search_form shortcode.
- Product
- Simple Download Monitor
- Fixed in
- 3.9.11
- What to do
- Update Simple Download Monitor to 3.9.11 or newer.
Jan 18, 2022ProfileGrid – User Profiles, Memberships, Groups and Communities: Stored Cross-Site ScriptingCVE-2022-0233 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
- Product
- ProfileGrid – User Profiles, Memberships, Groups and Communities
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update ProfileGrid – User Profiles, Memberships, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 18, 2022User Registration, Login & Landing Pages: Stored Cross-Site ScriptingCVE-2022-0232 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- User Registration, Login & Landing Pages
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update User Registration, Login & Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 17, 2022Modern Events Calendar Lite: Alloed any logged-in userCVE-2021-25046 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.2.0
- What to do
- Update Modern Events Calendar Lite to 6.2.0 or newer.
Jan 17, 2022EventCalendar: Does not escape some user input before outputting it back in attributesCVE-2021-25024 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
- Product
- EventCalendar
- Fixed in
- 1.1.51
- What to do
- Update EventCalendar to 1.1.51 or newer.
Jan 17, 2022SEUR Oficial: Does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-25005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- SEUR Oficial
- Fixed in
- 1.7.0
- What to do
- Update SEUR Oficial to 1.7.0 or newer.
Jan 10, 2022WPcalc: Does not sanitize user input into the 'did' parameter and uses it in a SQL statementCVE-2021-25054 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.
- Product
- WPcalc
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WPcalc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 10, 2022RegistrationMagic: Does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statementCVE-2021-24862 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
- Product
- RegistrationMagic
- Fixed in
- 5.0.1.6
- What to do
- Update RegistrationMagic to 5.0.1.6 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 3, 2022Site Reviews: Does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users)CVE-2021-24973 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
- Product
- Site Reviews
- Fixed in
- 5.17.3
- What to do
- Update Site Reviews to 5.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 3, 2022All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to mCVE-2021-24831 · WordPress plugins & themes · reported by WPScanHigh 7.5
All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.
- Product
- Tab
- Fixed in
- 1.3.2
- What to do
- Update Tab to 1.3.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.