Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

1,938 results · page 38 of 39

Jul 6, 2021WP Pro Real Estate 7: Did not properly sanitise the ct_community parameter in its search listing page before outputting it back in itCVE-2021-24387 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
Product
WP Pro Real Estate 7
Fixed in
3.1.1
What to do
Update WP Pro Real Estate 7 to 3.1.1 or newer.
Full record and what to do →NVD record contempothemes.com wpscan.com
Jul 6, 2021WP SVG images: Did not sanitise the SVG files uploadedCVE-2021-24386 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to editors and admin, with an option to also allow author to do so. The description of the plugin has also been updated with a security warning as upload of such content is intended.
Product
WP SVG images
Fixed in
3.4
What to do
Update WP SVG images to 3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021WP Google Maps: Did not sanitiseCVE-2021-24383 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Product
WP Google Maps
Fixed in
8.1.12
What to do
Update WP Google Maps to 8.1.12 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript blockCVE-2021-24373 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
Product
WP Hardening – Fix Your WordPress Security
Fixed in
1.2.2
What to do
Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attributeCVE-2021-24372 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
Product
WP Hardening – Fix Your WordPress Security
Fixed in
1.2.2
What to do
Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameCVE-2021-24361 · WordPress plugins & themes · reported by WPScanCritical 9.8
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.
Product
Location Manager
Fixed in
2.1.0.10
What to do
Update Location Manager to 2.1.0.10 or newer.
Full record and what to do →NVD record wpgeodirectory.com wpscan.com
Jun 20, 2021Quiz And Survey Master – Best Quiz, Exam and Survey: Did not sanitise or escape its result_id parameterCVE-2021-24368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link
Product
Quiz And Survey Master – Best Quiz, Exam and Survey
Fixed in
7.1.18
What to do
Update Quiz And Survey Master – Best Quiz, Exam and Survey to 7.1.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored CrCVE-2021-24382 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.
Fixed in
3.5.0.9
What to do
Update the plugin to 3.5.0.9 or newer.
Full record and what to do →NVD record smartslider.helpscoutdocs.com wpscan.com
Jun 14, 2021Yes/No Chart: Did not sanitise its sid shortcode parameter before using it in a SQL statementCVE-2021-24360 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege users (contributor+) to perform Blind SQL Injection attacks
Product
Yes/No Chart
Fixed in
1.0.12
What to do
Update Yes/No Chart to 1.0.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitisedCVE-2021-24357 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue.
Product
Best Image Gallery & Responsive Photo Gallery – FooGallery
Fixed in
2.0.35
What to do
Update Best Image Gallery & Responsive Photo Gallery – FooGallery to 2.0.35 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder: Did not properly sanitise some of its fieldsCVE-2021-24351 · WordPress plugins & themes · reported by WPScanMedium 6.1
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
Product
theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder
Fixed in
4.1.12
What to do
Update theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder to 4.1.12 or newer.
Full record and what to do →NVD record theplusaddons.com wpscan.com
Jun 14, 2021The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or esCVE-2021-24345 · WordPress plugins & themes · reported by WPScanMedium 6.6
The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
Product
Sendit WP Newsletter
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Sendit WP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 14, 2021When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitisedCVE-2021-24341 · WordPress plugins & themes · reported by WPScanHigh 8.8
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
Product
Xllentech English Islamic Calendar
Fixed in
2.6.8
What to do
Update Xllentech English Islamic Calendar to 2.6.8 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 7, 2021Easy Preloader: Does not sanitise its setting fieldsCVE-2021-24344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues
Product
Easy Preloader
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Easy Preloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2021iFlyChat: Does not sanitise its APP ID setting before outputting it back in the pageCVE-2021-24343 · WordPress plugins & themes · reported by WPScanMedium 4.8
The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue
Product
iFlyChat
Fixed in
4.7.0
What to do
Update iFlyChat to 4.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2021JNews: Did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*)CVE-2021-24342 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.
Product
JNews
Fixed in
8.0.6
What to do
Update JNews to 8.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2021WP Statistics: Relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the queryCVE-2021-24340 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
Product
WP Statistics
Fixed in
13.0.8
What to do
Update WP Statistics to 13.0.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 7, 2021The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped beforeCVE-2021-24337 · WordPress plugins & themes · reported by WPScanHigh 8.8
The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
Product
Video Embed
Affected
up to 1.0
What to do
Affects up to 1.0. Update Video Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 7, 2021FlightLog: Does not sanitiseCVE-2021-24336 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users
Product
FlightLog
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update FlightLog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 1, 2021Car Repair Services & Auto Mechanic: Did not properly sanitise its serviceestimatekey search parameter before outputting it back in the pageCVE-2021-24335 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
Product
Car Repair Services & Auto Mechanic
Fixed in
4.0
What to do
Update Car Repair Services & Auto Mechanic to 4.0 or newer.
Full record and what to do →NVD record m0ze.ru themeforest.net
Jun 1, 2021Instant Images – One Click Unsplash Uploads: Did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/uploadCVE-2021-24334 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue.
Product
Instant Images – One Click Unsplash Uploads
Fixed in
4.4.0.1
What to do
Update Instant Images – One Click Unsplash Uploads to 4.4.0.1 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Smooth Scroll Page Up/Down Buttons: Did not properly sanitise and validate its settingsCVE-2021-24331 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psb_distance, psb_buttonsize, psb_speed, only validating them client side. This could allow high privilege users (such as admin) to set XSS payloads in them
Product
Smooth Scroll Page Up/Down Buttons
Fixed in
1.4
What to do
Update Smooth Scroll Page Up/Down Buttons to 1.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Funnel Builder by CartFlows – Create High Converting Sales Funnels For: Did not sanitise its facebook_pixel_id and google_analytics_id settingsCVE-2021-24330 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.
Product
Funnel Builder by CartFlows – Create High Converting Sales Funnels For
Fixed in
1.6.13
What to do
Update Funnel Builder by CartFlows – Create High Converting Sales Funnels For to 1.6.13 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021WP Super Cache: Did not properly sanitise its wp_cache_location parameter in its settingsCVE-2021-24329 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue.
Product
WP Super Cache
Fixed in
1.7.3
What to do
Update WP Super Cache to 1.7.3 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Bello - Directory & Listing: Did not sanitise the bt_bb_listing_field_price_range_toCVE-2021-24321 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issues
Product
Bello - Directory & Listing
Fixed in
1.6.0
What to do
Update Bello - Directory & Listing to 1.6.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise and escape its listing_list_viewCVE-2021-24320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.
Product
Bello - Directory & Listing
Fixed in
1.6.0
What to do
Update Bello - Directory & Listing to 1.6.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ pageCVE-2021-24319 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue
Product
Bello - Directory & Listing
Fixed in
1.6.0
What to do
Update Bello - Directory & Listing to 1.6.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Listeo: Did not properly sanitise some parameters in its SearchCVE-2021-24317 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues
Product
Listeo
Fixed in
1.6.11
What to do
Update Listeo to 1.6.11 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021search feature of the Mediumish: Does not properly sanitise it's 's' GET parameter before output it back the pageCVE-2021-24316 · WordPress plugins & themes · reported by WPScanMedium 6.1
The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page, leading to the Cross-SIte Scripting issue.
Product
search feature of the Mediumish
Affected
up to 1.0.47
What to do
Affects up to 1.0.47. Update search feature of the Mediumish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Photo Gallery by 10Web - Mobile-Friendly Image Gallery: Did not properly sanitise the gallery titleCVE-2021-24310 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117
Product
Photo Gallery by 10Web - Mobile-Friendly Image Gallery
Fixed in
1.5.67
What to do
Update Photo Gallery by 10Web - Mobile-Friendly Image Gallery to 1.5.67 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021Autoptimize: Was missing proper escaping and sanitisation in some of its settingsCVE-2021-24332 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
Product
Autoptimize
Fixed in
2.8.4
What to do
Update Autoptimize to 2.8.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 24, 2021Ultimate Member – User Profile, User Registration, Login & Membership: Did not properly sanitiseCVE-2021-24306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.
Product
Ultimate Member – User Profile, User Registration, Login & Membership
Fixed in
2.1.20
What to do
Update Ultimate Member – User Profile, User Registration, Login & Membership to 2.1.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021slider import search feature of the PickPlugins Product Slider for WooCommerce: Did not properly sanitised the keyword GET parameterCVE-2021-24300 · WordPress plugins & themes · reported by WPScanMedium 6.1
The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue
Product
slider import search feature of the PickPlugins Product Slider for WooCommerce
Fixed in
1.13.22
What to do
Update slider import search feature of the PickPlugins Product Slider for WooCommerce to 1.13.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflecCVE-2021-24298 · WordPress plugins & themes · reported by WPScanMedium 6.1
The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS
Fixed in
2.36.2
What to do
Update the plugin to 2.36.2 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
May 24, 2021WP Customer Reviews: Did not sanitise some of its settingsCVE-2021-24296 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
Product
WP Customer Reviews
Fixed in
3.5.6
What to do
Update WP Customer Reviews to 3.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021dsgvoaio_write_log AJAX action of the DSGVO All in one for WP: Did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/adminCVE-2021-24294 · WordPress plugins & themes · reported by WPScanMedium 6.1
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
Product
dsgvoaio_write_log AJAX action of the DSGVO All in one for WP
Fixed in
4.0
What to do
Update dsgvoaio_write_log AJAX action of the DSGVO All in one for WP to 4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021SEO Redirection Plugin – 301 Redirect Manager: Did not sanitise the Redirect From and Redirect To fieldsCVE-2021-24327 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads
Product
SEO Redirection Plugin – 301 Redirect Manager
Fixed in
6.4
What to do
Update SEO Redirection Plugin – 301 Redirect Manager to 6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high CVE-2021-24323 · WordPress plugins & themes · reported by WPScanMedium 4.8
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
Fixed in
5.2.0
What to do
Update the plugin to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
Product
GiveWP – Donation Plugin and Fundraising Platform
Fixed in
2.10.4
What to do
Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 17, 2021Goto: Did not sanitiseCVE-2021-24314 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue
Product
Goto
Fixed in
2.1
What to do
Update Goto to 2.1 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 17, 2021It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress PluCVE-2021-24295 · WordPress plugins & themes · reported by WPScanHigh 7.5
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
Product
Spam protection, AntiSpam, FireWall by CleanTalk
Fixed in
5.153.4
What to do
Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.153.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 14, 2021settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24287 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
Product
settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
Fixed in
1.3.2
What to do
Update settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons to 1.3.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 14, 2021settings page of the Redirect 404 to parent: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24286 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
Product
settings page of the Redirect 404 to parent
Fixed in
1.3.1
What to do
Update settings page of the Redirect 404 to parent to 1.3.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 14, 2021The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.CVE-2021-24283 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.
Fixed in
2.2.30
What to do
Update the plugin to 2.2.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021RSS for Yandex Turbo: Did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the pageCVE-2021-24277 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues
Product
RSS for Yandex Turbo
Fixed in
1.30
What to do
Update RSS for Yandex Turbo to 1.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12,CVE-2021-24193 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Visitor Traffic Real Time Statistics
Fixed in
2.12
What to do
Update Visitor Traffic Real Time Statistics to 2.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from lack of sanitisation in the label of the Form FieldsCVE-2021-24250 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in the label of the Form Fields, leading to Authenticated Stored Cross-Site Scripting issues across various pages of the plugin.
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11.2
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Contact Form Check Tester: Settings are visible to all registered users in the dashboard and are lacking any sanitisationCVE-2021-24247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
Product
Contact Form Check Tester
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Contact Form Check Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX aCVE-2021-24246 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues
Product
Workscout Core
Fixed in
1.3.4
What to do
Update Workscout Core to 1.3.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 6, 2021The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected CCVE-2021-24214 · WordPress plugins & themes · reported by WPScanMedium 6.1
The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.