Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

1,938 results · page 38 of 39

May 2, 2023The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow useCVE-2023-1196 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
Fixed in
6.1.0
What to do
Update the plugin to 6.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023OoohBoi Steroids for Elementor: Has CSRF and broken access control vulnerabilitiesCVE-2023-0336 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.
Product
OoohBoi Steroids for Elementor
Fixed in
2.1.5
What to do
Update OoohBoi Steroids for Elementor to 2.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023WP Shamsi: Has CSRF and broken access control vulnerabilitiesCVE-2023-0335 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.
Product
WP Shamsi
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update WP Shamsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Content Control: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.
Product
Content Control
Fixed in
1.1.10
What to do
Update Content Control to 1.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 14, 2023Broken Access Control in Betheme theme <= 26.6.1 on WordPress.CVE-2022-45353 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Broken Access Control in Betheme theme <= 26.6.1 on WordPress.
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_save_mega_menu_settings' AJAX actionCVE-2022-4711 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to enable and modify Mega Menu settings for any menu item.
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_import_library_template' AJAX actionCVE-2022-4709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import and activate templates from the plugin's template library.
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_save_template_conditions' AJAX actionCVE-2022-4708 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to modify the conditions under which templates are displayed.
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_final_settings_setup' AJAX actionCVE-2022-4705 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation of preset site configuration templates, which can be chosen and imported via a separate action documented in CVE-2022-4704.
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_import_templates_kit' AJAX actionCVE-2022-4704 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site configuration templates including images and settings.
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_reset_previous_import' AJAX actionCVE-2022-4703 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to reset previously imported data.
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_fix_royal_compatibility' AJAX actionCVE-2022-4702 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on the site unless it is part of an extremely limited hardcoded selection. This also switches the site to the 'royal-elementor-kit' theme, potentially resulting in availability issues.
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_activate_required_plugins' AJAX actionCVE-2022-4701 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'contact-form-7', 'media-library-assistant', or 'woocommerce' plugins if they are installed on the site.
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_activate_required_theme' AJAX actionCVE-2022-4700 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'royal-elementor-kit' theme. If no such theme is installed doing so can also impact site availability as the site attempts to load a nonexistent theme.
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 26, 2022Menu Item Visibility Control: Doesn't sanitize and validate the "Visibility logic" option for WordPress menu itemsCVE-2021-24942 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.
Product
Menu Item Visibility Control
Affected
up to 0.5
What to do
Affects up to 0.5. Update Menu Item Visibility Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 18, 2022WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth: Broken Access ControlCVE-2022-41839 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.
Product
WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.CVE-2022-42461 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.
Affected
up to 5.6.1
What to do
Affects up to 5.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.CVE-2022-41781 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.
Affected
up to 2.2.20
What to do
Affects up to 2.2.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022WPML Multilingual CMS premium plugin <= 4.5.10 on: Broken Access ControlCVE-2022-38974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.
Product
WPML Multilingual CMS premium plugin <= 4.5.10 on
Affected
up to 4.5.10
What to do
Affects up to 4.5.10. Update WPML Multilingual CMS premium plugin <= 4.5.10 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022WPML Multilingual CMS premium plugin <= 4.5.10 on: Broken Access ControlCVE-2022-38461 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).
Product
WPML Multilingual CMS premium plugin <= 4.5.10 on
Affected
up to 4.5.10
What to do
Affects up to 4.5.10. Update WPML Multilingual CMS premium plugin <= 4.5.10 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 10, 2022Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.CVE-2022-42460 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.CVE-2022-38134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 12, 2022Dean Oakley's Photospace Gallery plugin <= 2.3.5 at: Broken Access ControlCVE-2022-38135 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.
Product
Dean Oakley's Photospace Gallery plugin <= 2.3.5 at
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Dean Oakley's Photospace Gallery plugin <= 2.3.5 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 6, 2022Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress.CVE-2022-37344 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 6, 2022About Rentals: Missing Access ControlCVE-2022-36427 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress.
Product
About Rentals
Affected
up to 1.5
What to do
Affects up to 1.5. Update About Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 6, 2022Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.CVE-2022-36387 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 6, 2022Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress.CVE-2022-36425 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress.
Affected
up to 2.5.4.3
What to do
Affects up to 2.5.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 5, 2022Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.CVE-2022-25649 · WordPress plugins & themes · reported by PatchstackMedium 5
Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.
Affected
up to 4.7.0
What to do
Affects up to 4.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record dzv365zjfbd8v.cloudfront.net patchstack.com
Jul 22, 2022Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.CVE-2022-27235 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 21, 2022YIKES Inc: Broken Access ControlCVE-2022-28666 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update.
Product
YIKES Inc
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update YIKES Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 15, 2022Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in MCVE-2022-28612 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Muneeb's Custom Popup Builder plugin <= 1.3.1 at WordPress.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022Cab fare calculator: Does not validate the controller parameter before using it in require statementsCVE-2022-1391 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.
Product
Cab fare calculator
Fixed in
1.0.4
What to do
Update Cab fare calculator to 1.0.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Apr 12, 2022Visual Form Builder: Does not perform access control on entry form exportCVE-2022-0140 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
Product
Visual Form Builder
Fixed in
3.0.6
What to do
Update Visual Form Builder to 3.0.6 or newer.
Full record and what to do →NVD record wpscan.com fortiguard.com
Mar 21, 2022Amelia: Stores image blobs into actual files whose extension is controlled by the userCVE-2022-0687 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
Product
Amelia
Fixed in
1.0.47
What to do
Update Amelia to 1.0.47 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022UsersWP: Is missing access controlsCVE-2022-0442 · WordPress plugins & themes · reported by WPScanMedium 4.3
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
Product
UsersWP
Fixed in
1.2.3.1
What to do
Update UsersWP to 1.2.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Rearrange Woocommerce Products: Does not have proper access controls in the save_all_order AJAX actionCVE-2021-24928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.
Product
Rearrange Woocommerce Products
Fixed in
3.0.8
What to do
Update Rearrange Woocommerce Products to 3.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not propeCVE-2021-24849 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
Product
WCFM Marketplace
Fixed in
3.4.12
What to do
Update WCFM Marketplace to 3.4.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Image Source Control: Allows users with a roleCVE-2021-24781 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (even those they should not be able to edit)
Product
Image Source Control
Fixed in
2.3.1
What to do
Update Image Source Control to 2.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 1, 2021WP Attachment Export: Does not have proper access controlsCVE-2015-20067 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
Product
WP Attachment Export
Fixed in
0.2.4
What to do
Update WP Attachment Export to 0.2.4 or newer.
Full record and what to do →NVD record github.com seclists.org
Sep 20, 2021Limit Login Attempts: Does not escape the IP addresses (which can be controlled by attacker via headers suchCVE-2021-24657 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
Product
Limit Login Attempts
Fixed in
4.0.50
What to do
Update Limit Login Attempts to 4.0.50 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24584 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues
Product
Timetable and Event Schedule
Fixed in
2.4.2
What to do
Update Timetable and Event Schedule to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24583 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
Product
Timetable and Event Schedule
Fixed in
2.4.2
What to do
Update Timetable and Event Schedule to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021HM Multiple Roles: Does not have any access control to prevent low privilege users to set themselvesCVE-2021-24602 · WordPress plugins & themes · reported by WPScanHigh 8.8
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
Product
HM Multiple Roles
Fixed in
1.3
What to do
Update HM Multiple Roles to 1.3 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2.CVE-2021-24215 · WordPress plugins & themes · reported by WPScanCritical 9.8
An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.
Product
Controlled Admin Access
Fixed in
1.5.2
What to do
Update Controlled Admin Access to 1.5.2 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Apr 12, 2021wpDataTables – Tables & Table Charts premium: Has Improper Access ControlCVE-2021-24198 · WordPress plugins & themes · reported by WPScanHigh 8.1
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through id_key and id_val parameters. By exploiting this issue an attacker is able to delete the data of all users in the same table.
Product
wpDataTables – Tables & Table Charts premium
Fixed in
3.4.2
What to do
Update wpDataTables – Tables & Table Charts premium to 3.4.2 or newer.
Full record and what to do →NVD record n4nj0.github.io wpdatatables.com
Apr 12, 2021wpDataTables – Tables & Table Charts premium: Has Improper Access ControlCVE-2021-24197 · WordPress plugins & themes · reported by WPScanHigh 8.1
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to access the data of another user that are present in the same table by taking over the user permissions on the table through formdata[wdt_ID] parameter. By exploiting this issue an attacker is able to access and manage the data of all users in the same table.
Product
wpDataTables – Tables & Table Charts premium
Fixed in
3.4.2
What to do
Update wpDataTables – Tables & Table Charts premium to 3.4.2 or newer.
Full record and what to do →NVD record n4nj0.github.io wpdatatables.com
Dec 13, 2020vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control.CVE-2020-35235 · WordPress plugins & themes · reported by MITREHigh 8.8
vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Product
vendor/elfinder/php/connector.minimal.php in the secure-file-manager
Affected
up to 2.5
What to do
Affects up to 2.5. Update vendor/elfinder/php/connector.minimal.php in the secure-file-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks.CVE-2020-14205 · WordPress plugins & themes · reported by MITREMedium 5.3
The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks. An attacker may leverage this issue to manipulate the integrity of dive logs.
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org hooperlabs.xyz
Sep 16, 2020A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions.CVE-2020-20406 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 22, 2020The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.CVE-2020-12073 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.
Product
responsive-add-ons
Fixed in
2.2.7
What to do
Update responsive-add-ons to 2.2.7 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.