Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,202 results · page 36 of 45
Jun 8, 2022Discy: Lacks CSRF checks in some AJAX actionsCVE-2022-1421 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack
- Product
- Discy
- Fixed in
- 5.2
- What to do
- Update Discy to 5.2 or newer.
Jun 8, 2022User Meta: Does not validate the filepath parameter of its um_show_uploaded_file AJAX actionCVE-2022-0779 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads
- Product
- User Meta
- Fixed in
- 2.4.4
- What to do
- Update User Meta to 2.4.4 or newer.
May 30, 2022Content Mask: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2022-1203 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
- Product
- Content Mask
- Fixed in
- 1.8.4.1
- What to do
- Update Content Mask to 1.8.4.1 or newer.
May 25, 2022Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.CVE-2022-29408 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 23, 2022WP Contacts Manager: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1014 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.
- Product
- WP Contacts Manager
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Contacts Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
- Product
- Nirweb support
- Fixed in
- 2.8.2
- What to do
- Update Nirweb support to 2.8.2 or newer.
May 16, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX actionCVE-2022-1465 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.
- Product
- WPC Smart Wishlist for WooCommerce
- Fixed in
- 2.9.9
- What to do
- Update WPC Smart Wishlist for WooCommerce to 2.9.9 or newer.
May 16, 2022Visual Slide Box Builder: Does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (suchCVE-2022-1182 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections
- Product
- Visual Slide Box Builder
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Visual Slide Box Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022AGIL: Accepts all zip files and automatically extracts the zip file without validating the extracted file typeCVE-2021-25119 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
- Product
- AGIL
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update AGIL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022SEMA API: Does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX actionCVE-2022-0836 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users
- Product
- SEMA API
- Fixed in
- 4.02
- What to do
- Update SEMA API to 4.02 or newer.
May 9, 2022WP Video Gallery: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCVE-2022-0826 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- WP Video Gallery
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update WP Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022BadgeOS: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCVE-2022-0817 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- BadgeOS
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update BadgeOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022Ubigeo de Perú para Woocommerce: Does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actionsCVE-2022-0814 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
- Product
- Ubigeo de Perú para Woocommerce
- Fixed in
- 3.6.4
- What to do
- Update Ubigeo de Perú para Woocommerce to 3.6.4 or newer.
May 9, 2022Popup by Supsystic: Does not have any authentication and authorisation in an AJAX actionCVE-2022-0424 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
- Product
- Popup by Supsystic
- Fixed in
- 1.10.9
- What to do
- Update Popup by Supsystic to 1.10.9 or newer.
May 2, 2022Multiple Shipping Address Woocommerce: Does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated usersCVE-2022-0783 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
- Product
- Multiple Shipping Address Woocommerce
- Fixed in
- 2.0
- What to do
- Update Multiple Shipping Address Woocommerce to 2.0 or newer.
Apr 25, 2022Menubar: Does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users)CVE-2022-1152 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting
- Product
- Menubar
- Fixed in
- 5.8
- What to do
- Update Menubar to 5.8 or newer.
Apr 25, 2022myCred: Does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX actionCVE-2022-1092 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog
- Product
- myCred
- Fixed in
- 2.4.3.1
- What to do
- Update myCred to 2.4.3.1 or newer.
Apr 25, 2022Page Restriction WordPress (WP): Allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator uCVE-2022-1027 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator users.
- Product
- Page Restriction WordPress (WP)
- Fixed in
- 1.2.7
- What to do
- Update Page Restriction WordPress (WP) to 1.2.7 or newer.
Apr 25, 2022Donations: Does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated usersCVE-2022-0782 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- Donations
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022Users Ultra: Fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and auCVE-2022-0769 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.
- Product
- Users Ultra
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Users Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022Master Elements: Does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2022-0693 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection
- Product
- Master Elements
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Master Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022Web To Print Shop : uDraw: Does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function CVE-2022-0656 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
- Product
- Web To Print Shop : uDraw
- Fixed in
- 3.3.3
- What to do
- Update Web To Print Shop : uDraw to 3.3.3 or newer.
Apr 25, 2022ThirstyAffiliates: Lacks authorization checks in the ta_insert_external_image actionCVE-2022-0634 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request.
- Product
- ThirstyAffiliates
- Fixed in
- 3.10.5
- What to do
- Update ThirstyAffiliates to 3.10.5 or newer.
Apr 25, 2022myCred: Does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX actionCVE-2022-0363 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
- Product
- myCred
- Fixed in
- 2.4.3.1
- What to do
- Update myCred to 2.4.3.1 or newer.
Apr 25, 2022myCred: Does not have any authorisation in place in its mycred-tools-select-user AJAX actionCVE-2022-0287 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog
- Product
- myCred
- Fixed in
- 2.4.4.1
- What to do
- Update myCred to 2.4.4.1 or newer.
Apr 25, 2022Tatsu: Add_custom_font action can be used without prior authentication to upload a rogue zip fileCVE-2021-25094 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.
- Product
- Tatsu
- Fixed in
- 3.3.12
- What to do
- Update Tatsu to 3.3.12 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comdarkpills.com
Apr 25, 2022Advanced Page Visit Counter: Does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX actionCVE-2021-24957 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection
- Product
- Advanced Page Visit Counter
- Fixed in
- 6.1.6
- What to do
- Update Advanced Page Visit Counter to 6.1.6 or newer.
Apr 19, 2022Elementor Website Builder: Unauthorized execution of several AJAX actionsCVE-2022-1329 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
- Product
- Elementor Website Builder
- Affected
- 3.6.0 to 3.6.2
- What to do
- Affects 3.6.0 to 3.6.2. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Apr 18, 2022Product Table for WooCommerce (wooproducttable): Does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
- Product
- Product Table for WooCommerce (wooproducttable)
- Fixed in
- 3.1.2
- What to do
- Update Product Table for WooCommerce (wooproducttable) to 3.1.2 or newer.
Apr 18, 2022Daily Prayer Time: Does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users)CVE-2022-0785 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
- Product
- Daily Prayer Time
- Fixed in
- 2022.03.01
- What to do
- Update Daily Prayer Time to 2022.03.01 or newer.
Apr 18, 2022The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in tCVE-2021-25120 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues
- Fixed in
- 6.2.7
- What to do
- Update the plugin to 6.2.7 or newer.
Apr 18, 2022Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin.CVE-2022-23975 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 15, 2022Cross-Site Request Forgery (CSRF) in Use Any Font (WordPress plugin) <= 6.1.7 allows an attacker to deactivate the API key.CVE-2022-27851 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in Use Any Font (WordPress plugin) <= 6.1.7 allows an attacker to deactivate the API key.
- Affected
- up to 6.1.7
- What to do
- Affects up to 6.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Post Grid: Does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX actionCVE-2022-0447 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting
- Product
- Post Grid
- Fixed in
- 2.1.16
- What to do
- Update Post Grid to 2.1.16 or newer.
Apr 11, 2022LearnPress: Does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX actionCVE-2022-0271 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- LearnPress
- Fixed in
- 4.1.6
- What to do
- Update LearnPress to 4.1.6 or newer.
Apr 11, 2022Portfolio Gallery, Product Catalog: Does not have authorisation and CSRF checks in various functions related to AJAX actionsCVE-2021-25090 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
- Product
- Portfolio Gallery, Product Catalog
- Fixed in
- 2.1.0
- What to do
- Update Portfolio Gallery, Product Catalog to 2.1.0 or newer.
Apr 11, 2022Social Share, Social Login and Social Comments: Does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it CVE-2021-24987 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.30
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.30 or newer.
Apr 4, 2022Material Design for Contact Form 7: Does not check authorization or that the option mentioned in the notice param belongs to the pluginCVE-2022-0404 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.
- Product
- Material Design for Contact Form 7
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Material Design for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022SpeakOut! Email Petitions: Does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX actionCVE-2022-0846 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- SpeakOut! Email Petitions
- Fixed in
- 2.14.15.1
- What to do
- Update SpeakOut! Email Petitions to 2.14.15.1 or newer.
Mar 28, 2022Church Admin: Does not have authorisation and CSRF in some of its actionCVE-2022-0833 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin's DB data
- Product
- Church Admin
- Fixed in
- 3.4.135
- What to do
- Update Church Admin to 3.4.135 or newer.
Mar 28, 2022WooCommerce Affiliate: Does not have authorization and CSRF checks on a specific action handlerCVE-2022-0818 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.
- Product
- WooCommerce Affiliate
- Fixed in
- 4.16.4.5
- What to do
- Update WooCommerce Affiliate to 4.16.4.5 or newer.
Mar 28, 2022Limit Login Attempts (Spam Protection): Does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users)CVE-2022-0787 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections
- Product
- Limit Login Attempts (Spam Protection)
- Fixed in
- 5.1
- What to do
- Update Limit Login Attempts (Spam Protection) to 5.1 or newer.
Mar 28, 2022Title Experiments Free: Does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users)CVE-2022-0784 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
- Product
- Title Experiments Free
- Fixed in
- 9.0.1
- What to do
- Update Title Experiments Free to 9.0.1 or newer.
Mar 28, 2022Narnoo Distributor: Fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticatCVE-2022-0679 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.
- Product
- Narnoo Distributor
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Narnoo Distributor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Drag and Drop Multiple File Upload: Allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX actionCVE-2022-0595 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
- Product
- Drag and Drop Multiple File Upload
- Fixed in
- 1.3.6.3
- What to do
- Update Drag and Drop Multiple File Upload to 1.3.6.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 28, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user)CVE-2022-0397 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- Product
- WPC Smart Wishlist for WooCommerce
- Fixed in
- 2.9.4
- What to do
- Update WPC Smart Wishlist for WooCommerce to 2.9.4 or newer.
Mar 28, 2022Interactive Medical Drawing of Human Body: Does not sanitise and escape the Link fieldCVE-2022-0388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Interactive Medical Drawing of Human Body
- Fixed in
- 2.6
- What to do
- Update Interactive Medical Drawing of Human Body to 2.6 or newer.
Mar 28, 2022OSMapper: Contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefixCVE-2021-24978 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete is a map one. As a result, unauthenticated user can delete arbitrary posts from the blog
- Product
- OSMapper
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update OSMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 21, 2022Simple Link Directory: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0760 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
- Product
- Simple Link Directory
- Fixed in
- 7.7.2
- What to do
- Update Simple Link Directory to 7.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Infographic Maker: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0747 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
- Product
- Infographic Maker
- Fixed in
- 4.3.8
- What to do
- Update Infographic Maker to 4.3.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.