Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,978 results · page 37 of 40
Jan 17, 2022EventCalendar: Does not escape some user input before outputting it back in attributesCVE-2021-25024 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
- Product
- EventCalendar
- Fixed in
- 1.1.51
- What to do
- Update EventCalendar to 1.1.51 or newer.
Jan 10, 2022WPcalc: Does not sanitize user input into the 'did' parameter and uses it in a SQL statementCVE-2021-25054 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.
- Product
- WPcalc
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WPcalc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 3, 2022Booking Calendar: Does not sanitise and escape the booking_type parameter before outputting it back in an admin pageCVE-2021-25040 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Booking Calendar
- Fixed in
- 8.9.2
- What to do
- Update Booking Calendar to 8.9.2 or newer.
Jan 3, 2022OMGF | Host Google Fonts Locally: Does not validate the cache directory settingCVE-2021-25021 · WordPress plugins & themes · reported by WPScanMedium 4.9
The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
- Product
- OMGF | Host Google Fonts Locally
- Fixed in
- 4.5.12
- What to do
- Update OMGF | Host Google Fonts Locally to 4.5.12 or newer.
Jan 3, 2022CAOS | Host Google Analytics Locally: Does not validate the cache directory settingCVE-2021-25020 · WordPress plugins & themes · reported by WPScanMedium 4.9
The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
- Product
- CAOS | Host Google Analytics Locally
- Fixed in
- 4.1.9
- What to do
- Update CAOS | Host Google Analytics Locally to 4.1.9 or newer.
Jan 3, 2022Mortgage Calculator / Loan Calculator: Does not escape the some of the attributes of its mlcalc shortcode before outputting themCVE-2021-24828 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Mortgage Calculator / Loan Calculator
- Fixed in
- 1.5.17
- What to do
- Update Mortgage Calculator / Loan Calculator to 1.5.17 or newer.
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX actionCVE-2021-24946 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.1.5
- What to do
- Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.1.5
- What to do
- Update Modern Events Calendar Lite to 6.1.5 or newer.
Dec 13, 2021Caldera Forms: Does not sanitise and escape the Form Name before outputting it in attributesCVE-2021-24896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Caldera Forms
- Fixed in
- 1.9.5
- What to do
- Update Caldera Forms to 1.9.5 or newer.
Dec 13, 2021Flex Local Fonts: Does not escape the Class Name fieldCVE-2021-24782 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flex Local Fonts
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Flex Local Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2021Registrations for the Events Calendar: Does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2021-24943 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.7.6
- What to do
- Update Registrations for the Events Calendar to 2.7.6 or newer.
Nov 29, 2021My Calendar: Does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24927 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- My Calendar
- Fixed in
- 3.2.18
- What to do
- Update My Calendar to 3.2.18 or newer.
Nov 29, 2021Registrations for the Events Calendar: Does not escape the v parameter before outputting it back in an attributeCVE-2021-24876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.7.5
- What to do
- Update Registrations for the Events Calendar to 2.7.5 or newer.
Nov 29, 2021Stylish Cost Calculator: Does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users)CVE-2021-24822 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters
- Product
- Stylish Cost Calculator
- Fixed in
- 7.0.4
- What to do
- Update Stylish Cost Calculator to 7.0.4 or newer.
Nov 24, 2021Booking Package - Appointment Booking Calendar System versions prior to 1.5.11: Cross-site scriptingCVE-2021-20840 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- Booking Package - Appointment Booking Calendar System versions prior to 1.5.11
- Fixed in
- 1.5.11
- What to do
- Update Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 to 1.5.11 or newer.
Nov 8, 2021Chameleon CSS: Does not have any CSRF and capability checks in all its AJAX callsCVE-2021-24626 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection
- Product
- Chameleon CSS
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Chameleon CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.3
- What to do
- Update Modern Events Calendar Lite to 5.22.3 or newer.
Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.2
- What to do
- Update Modern Events Calendar Lite to 5.22.2 or newer.
Oct 4, 2021Appointment Hour Booking: Does not escape some of the Calendar Form settingsCVE-2021-24673 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.16
- What to do
- Update Appointment Hour Booking to 1.3.16 or newer.
Sep 27, 2021WordPress uListing: Unauthenticated Privilege EscalationCVE-2021-36879 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration.
- Product
- WordPress uListing
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update WordPress uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 20, 2021Availability Calendar: Does not escape the category attribute from its shortcode before using it in a SQL statementCVE-2021-24606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
- Product
- Availability Calendar
- Fixed in
- 1.2.1
- What to do
- Update Availability Calendar to 1.2.1 or newer.
Sep 20, 2021Availability Calendar: Does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embedCVE-2021-24604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Availability Calendar
- Fixed in
- 1.2.2
- What to do
- Update Availability Calendar to 1.2.2 or newer.
Sep 13, 2021WP Simple Booking Calendar: Did not escapeCVE-2021-24726 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue
- Product
- WP Simple Booking Calendar
- Fixed in
- 2.0.6
- What to do
- Update WP Simple Booking Calendar to 2.0.6 or newer.
Full record and what to do →NVD recordwpscan.comtrustwave.com
Sep 13, 2021MF Gig Calendar: Does not sanitise and escape the id GET parameter before outputting back in the admin dashboardCVE-2021-24510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
- Product
- MF Gig Calendar
- Fixed in
- 1.2
- What to do
- Update MF Gig Calendar to 1.2 or newer.
Sep 10, 2021wp-publications: Restrictive local file inclusionCVE-2021-38360 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which allows attackers to include local zip files and achieve remote code execution, in versions up to and including 0.0.
- Product
- wp-publications
- Affected
- up to 0.0
- What to do
- Affects up to 0.0. Update wp-publications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 23, 2021The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement witCVE-2021-24555 · WordPress plugins & themes · reported by WPScanHigh 8.8
The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and capability check, making it available to any authenticated user.
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 23, 2021Timeline Calendar: Does not sanitiseCVE-2021-24553 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin
- Product
- Timeline Calendar
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Timeline Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 23, 2021Simple Events Calendar: Does not sanitiseCVE-2021-24552 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue
- Product
- Simple Events Calendar
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Simple Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 16, 2021Calendar_plugin: Reflected Cross-Site ScriptingCVE-2021-34667 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calendar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
- Product
- Calendar_plugin
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Calendar_plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 16, 20212Way VideoCalls and Random Chat - HTML5 Webcam Videochat: Reflected Cross-Site ScriptingCVE-2021-34656 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_notice` function found in the ~/inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7.
- Product
- 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat
- Affected
- up to 5.2.7
- What to do
- Affects up to 5.2.7. Update 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 9, 2021Workreap: Had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations suchCVE-2021-24501 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site.
- Product
- Workreap
- Fixed in
- 2.2.2
- What to do
- Update Workreap to 2.2.2 or newer.
Aug 2, 2021Calendar Event Multi View: Does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/editCVE-2021-24498 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.
- Product
- Calendar Event Multi View
- Fixed in
- 1.4.01
- What to do
- Update Calendar Event Multi View to 1.4.01 or newer.
Aug 2, 2021The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does nCVE-2021-24492 · WordPress plugins & themes · reported by WPScanHigh 8.8
The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
- Product
- Handsome Testimonials & Reviews
- Fixed in
- 2.1.1
- What to do
- Update Handsome Testimonials & Reviews to 2.1.1 or newer.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 2, 2021get_reports() function in the Secure Copy Content Protection and Content Locking: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24484 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_reports() function in the Secure Copy Content Protection and Content Locking
- Fixed in
- 2.6.7
- What to do
- Update get_reports() function in the Secure Copy Content Protection and Content Locking to 2.6.7 or newer.
Aug 2, 2021get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24483 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker
- Fixed in
- 3.2.1
- What to do
- Update get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker to 3.2.1 or newer.
Aug 2, 2021get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24463 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel
- Fixed in
- 2.5.0
- What to do
- Update get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel to 2.5.0 or newer.
Aug 2, 2021get_faqs() function in the FAQ Builder AYS: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24461 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_faqs() function in the FAQ Builder AYS
- Fixed in
- 1.3.6
- What to do
- Update get_faqs() function in the FAQ Builder AYS to 1.3.6 or newer.
Aug 2, 2021get_fb_likeboxes() function in the Popup Like box – Page: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24460 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_fb_likeboxes() function in the Popup Like box – Page
- Fixed in
- 3.5.3
- What to do
- Update get_fb_likeboxes() function in the Popup Like box – Page to 3.5.3 or newer.
Aug 2, 2021get_results() and get_items() functions in the Survey Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24459 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_results() and get_items() functions in the Survey Maker
- Fixed in
- 1.5.6
- What to do
- Update get_results() and get_items() functions in the Survey Maker to 1.5.6 or newer.
Aug 2, 2021get_ays_popupboxes() and get_popup_categories() functions of the Popup box: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24458 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_ays_popupboxes() and get_popup_categories() functions of the Popup box
- Fixed in
- 2.3.4
- What to do
- Update get_ays_popupboxes() and get_popup_categories() functions of the Popup box to 2.3.4 or newer.
Jul 30, 2021The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher CVE-2020-11511 · WordPress plugins & themes · reported by MITREHigh 8.1
The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.
- Product
- LearnPress
- Fixed in
- 3.2.6.9
- What to do
- Update LearnPress to 3.2.6.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comcwe.mitre.org
Jul 19, 2021Include Me: Is vulnerable to path traversal / local file inclusionCVE-2021-24453 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution (RCE) of the system due to log poisoning and therefore potentially a full compromise of the underlying structure
- Product
- Include Me
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Include Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2021WP Fluent Forms plugin < 3.6.67: Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege EscalationCVE-2021-34620 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
- Product
- WP Fluent Forms plugin < 3.6.67
- What to do
- Update WP Fluent Forms plugin < 3.6.67 to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 14, 2021Plus Addons for Elementor Page Builder: Did not validate a redirect parameter on a specifically crafted URL before redirecting the user to itCVE-2021-24358 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.
- Product
- Plus Addons for Elementor Page Builder
- Fixed in
- 4.1.10
- What to do
- Update Plus Addons for Elementor Page Builder to 4.1.10 or newer.
Full record and what to do →NVD recordtheplusaddons.comwpscan.com
Jun 14, 2021When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitisedCVE-2021-24341 · WordPress plugins & themes · reported by WPScanHigh 8.8
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
- Product
- Xllentech English Islamic Calendar
- Fixed in
- 2.6.8
- What to do
- Update Xllentech English Islamic Calendar to 2.6.8 or newer.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
May 24, 2021The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability.CVE-2021-24305 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized.
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comtargetfirst.com
May 14, 2021The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticatCVE-2021-24285 · WordPress plugins & themes · reported by WPScanCritical 9.8
The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
- Product
- Car Seller - Auto Classifieds Script
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Car Seller - Auto Classifieds Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin beforeCVE-2021-24195 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Login as User or Customer (User Switching)
- Fixed in
- 1.8
- What to do
- Update Login as User or Customer (User Switching) to 1.8 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin beCVE-2021-24194 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Login Protection - Limit Failed Login Attempts
- Fixed in
- 2.9
- What to do
- Update Login Protection - Limit Failed Login Attempts to 2.9 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12,CVE-2021-24193 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Visitor Traffic Real Time Statistics
- Fixed in
- 2.12
- What to do
- Update Visitor Traffic Real Time Statistics to 2.12 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.