Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,981 results · page 42 of 60

Jun 7, 2021iFlyChat: Does not sanitise its APP ID setting before outputting it back in the pageCVE-2021-24343 · WordPress plugins & themes · reported by WPScanMedium 4.8
The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue
Product
iFlyChat
Fixed in
4.7.0
What to do
Update iFlyChat to 4.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 1, 2021Car Repair Services & Auto Mechanic: Did not properly sanitise its serviceestimatekey search parameter before outputting it back in the pageCVE-2021-24335 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
Product
Car Repair Services & Auto Mechanic
Fixed in
4.0
What to do
Update Car Repair Services & Auto Mechanic to 4.0 or newer.
Full record and what to do →NVD record m0ze.ru themeforest.net
Jun 1, 2021Database Backup for: Did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tagCVE-2021-24322 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
Product
Database Backup for
Fixed in
2.4
What to do
Update Database Backup for to 2.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ pageCVE-2021-24319 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue
Product
Bello - Directory & Listing
Fixed in
1.6.0
What to do
Update Bello - Directory & Listing to 1.6.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021search feature of the Mediumish: Does not properly sanitise it's 's' GET parameter before output it back the pageCVE-2021-24316 · WordPress plugins & themes · reported by WPScanMedium 6.1
The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page, leading to the Cross-SIte Scripting issue.
Product
search feature of the Mediumish
Affected
up to 1.0.47
What to do
Affects up to 1.0.47. Update search feature of the Mediumish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 24, 2021The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflecCVE-2021-24298 · WordPress plugins & themes · reported by WPScanMedium 6.1
The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS
Fixed in
2.36.2
What to do
Update the plugin to 2.36.2 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
May 17, 2021404 SEO Redirection: Is lacking CSRF checks in all its settingsCVE-2021-24324 · WordPress plugins & themes · reported by WPScanMedium 6.5
The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues
Product
404 SEO Redirection
Affected
up to 1.3
What to do
Affects up to 1.3. Update 404 SEO Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high CVE-2021-24323 · WordPress plugins & themes · reported by WPScanMedium 4.8
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
Fixed in
5.2.0
What to do
Update the plugin to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
Product
GiveWP – Donation Plugin and Fundraising Platform
Fixed in
2.10.4
What to do
Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 17, 2021There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicCVE-2021-24290 · WordPress plugins & themes · reported by WPScanMedium 6.1
There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.
Product
Store Locator Plus for
Affected
up to 5.5.15
What to do
Affects up to 5.5.15. Update Store Locator Plus for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
May 14, 2021settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24287 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
Product
settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
Fixed in
1.3.2
What to do
Update settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons to 1.3.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 14, 2021settings page of the Redirect 404 to parent: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24286 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
Product
settings page of the Redirect 404 to parent
Fixed in
1.3.1
What to do
Update settings page of the Redirect 404 to parent to 1.3.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 14, 2021The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.CVE-2021-24283 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.
Fixed in
2.2.30
What to do
Update the plugin to 2.2.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021RSS for Yandex Turbo: Did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the pageCVE-2021-24277 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues
Product
RSS for Yandex Turbo
Fixed in
1.30
What to do
Update RSS for Yandex Turbo to 1.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin beforeCVE-2021-24195 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Login as User or Customer (User Switching)
Fixed in
1.8
What to do
Update Login as User or Customer (User Switching) to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin beCVE-2021-24194 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Login Protection - Limit Failed Login Attempts
Fixed in
2.9
What to do
Update Login Protection - Limit Failed Login Attempts to 2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12,CVE-2021-24193 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Visitor Traffic Real Time Statistics
Fixed in
2.12
What to do
Update Visitor Traffic Real Time Statistics to 2.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (iCVE-2021-24192 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Tree Sitemap
Fixed in
2.9
What to do
Update Tree Sitemap to 2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin befCVE-2021-24191 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
WP Maintenance Mode & Site Under Construction
Fixed in
1.8.2
What to do
Update WP Maintenance Mode & Site Under Construction to 1.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1CVE-2021-24190 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
WooCommerce Conditional Marketing Mailer
Fixed in
1.5.2
What to do
Update WooCommerce Conditional Marketing Mailer to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress pluginCVE-2021-24189 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Captchinoo, Google recaptcha for admin login page
Fixed in
2.4
What to do
Update Captchinoo, Google recaptcha for admin login page to 2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin beforCVE-2021-24188 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
WP Content Copy Protection & No Right Click
Fixed in
3.1.5
What to do
Update WP Content Copy Protection & No Right Click to 3.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from lack of sanitisation in the label of the Form FieldsCVE-2021-24250 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in the label of the Form Fields, leading to Authenticated Stored Cross-Site Scripting issues across various pages of the plugin.
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11.2
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Contact Form Check Tester: Settings are visible to all registered users in the dashboard and are lacking any sanitisationCVE-2021-24247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
Product
Contact Form Check Tester
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Contact Form Check Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected CCVE-2021-24214 · WordPress plugins & themes · reported by WPScanMedium 6.1
The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
May 5, 2021Elementor Addons – PowerPack Addons for Elementor: For WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24263 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addons – PowerPack Addons for Elementor
Fixed in
2.3.2
What to do
Update Elementor Addons – PowerPack Addons for Elementor to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 22, 2021Business Hours Pro: Allows a remote attacker to upload arbitrary files using its manual update functionalityCVE-2021-24240 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.
Product
Business Hours Pro
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Business Hours Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wpscan.com
Apr 12, 2021The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged adCVE-2021-24231 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link.
Product
Patreon
Fixed in
1.7.0
What to do
Update Patreon to 1.7.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged inCVE-2021-24230 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content.
Product
Patreon
Fixed in
1.7.0
What to do
Update Patreon to 1.7.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin befoCVE-2021-24229 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
Fixed in
1.7.2
What to do
Update the plugin to 1.7.2 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon: The WordPress login form (wp-loginCVE-2021-24228 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized.
Product
Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon
Fixed in
1.7.2
What to do
Update Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon to 1.7.2 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon: That could be abused by anyone visiting the siteCVE-2021-24227 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
Product
Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon
Fixed in
1.7.0
What to do
Update Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon to 1.7.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for: Were vulnerable to CSRF due to a lack of nonce protectionCVE-2021-24218 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.
Product
wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for
Fixed in
3.0.4
What to do
Update wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redireCVE-2021-24210 · WordPress plugins & themes · reported by WPScanMedium 6.1
There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/) that says that the php involved in the request only go to whitelisted pages but it's possible to redirect the victim to any domain.
Product
PhastPress
Fixed in
1.111
What to do
Update PhastPress to 1.111 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 5, 2021Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerabCVE-2021-24180 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.
Fixed in
2.0.4
What to do
Update the plugin to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021Database Backups: Does not have CSRF checksCVE-2021-24174 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
Product
Database Backups
Affected
up to 1.2.2.6
What to do
Affects up to 1.2.2.6. Update Database Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Apr 5, 2021VM Backups: Does not have CSRF checksCVE-2021-24173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue.
Product
VM Backups
Affected
up to 1.0
What to do
Affects up to 1.0. Update VM Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021VM Backups: Does not have CSRF checksCVE-2021-24172 · WordPress plugins & themes · reported by WPScanMedium 4.3
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current .
Product
VM Backups
Affected
up to 1.0
What to do
Affects up to 1.0. Update VM Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for: Had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connectionCVE-2021-24166 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.
Product
wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for
Fixed in
3.4.34
What to do
Update wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for to 3.4.34 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings.CVE-2021-24162 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.
Fixed in
4.0.4
What to do
Update the plugin to 4.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive conCVE-2021-24161 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site.
Fixed in
4.0.4
What to do
Update the plugin to 4.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a siCVE-2021-24159 · WordPress plugins & themes · reported by WPScanHigh 8.8
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021WordPress Backup and Migrate Plugin – Backup Guard: Did not ensure that the imported files are of the SGBP format and extensionCVE-2021-24155 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
Product
WordPress Backup and Migrate Plugin – Backup Guard
Fixed in
1.6.0
What to do
Update WordPress Backup and Migrate Plugin – Backup Guard to 1.6.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Apr 5, 2021A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blackCVE-2021-24153 · WordPress plugins & themes · reported by WPScanMedium 5.4
A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.
Product
Yoast SEO
Fixed in
3.4.1
What to do
Update Yoast SEO to 3.4.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Mar 18, 2021Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment fielCVE-2021-24147 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
Product
Modern Events Calendar Lite
Fixed in
5.16.5
What to do
Update Modern Events Calendar Lite to 5.16.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, CVE-2021-24146 · WordPress plugins & themes · reported by WPScanHigh 7.5
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
Product
Modern Events Calendar Lite
Fixed in
5.16.5
What to do
Update Modern Events Calendar Lite to 5.16.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Mar 18, 2021Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitraryCVE-2021-24144 · WordPress plugins & themes · reported by WPScanHigh 7.8
Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files.
Fixed in
1.2.5.6
What to do
Update the plugin to 1.2.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabCVE-2021-24136 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL
Product
Testimonials Widget
Fixed in
4.0.0
What to do
Update Testimonials Widget to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vCVE-2021-24135 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.
Product
WP Customer Reviews
Fixed in
3.4.3
What to do
Update WP Customer Reviews to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site ScriptinCVE-2021-24134 · WordPress plugins & themes · reported by WPScanMedium 4.8
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
Product
Constant Contact Forms
Fixed in
1.8.8
What to do
Update Constant Contact Forms to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.