Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,771 results · page 464 of 496
Feb 28, 2022Migration, Backup, Staging: Does not have authorisationCVE-2021-24994 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.69
- What to do
- Update Migration, Backup, Staging to 0.9.69 or newer.
Feb 28, 2022Use Any Font | Custom Font Uploader: Does not have any authorisation checksCVE-2021-24977 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues
- Product
- Use Any Font | Custom Font Uploader
- Fixed in
- 6.2.1
- What to do
- Update Use Any Font | Custom Font Uploader to 6.2.1 or newer.
Feb 28, 2022WP Responsive Menu: Does not have capability and CSRF checks in the wpr_live_update AJAX actionCVE-2021-24971 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin's settings and perform Cross-Site Scripting attacks against all visitor and users on the frontend
- Product
- WP Responsive Menu
- Fixed in
- 3.1.7.1
- What to do
- Update WP Responsive Menu to 3.1.7.1 or newer.
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF check in the lswss_save_attachment_data AJAX actionCVE-2021-24913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.
- Product
- Logo Showcase with Slick Slider
- Fixed in
- 2.0.1
- What to do
- Update Logo Showcase with Slick Slider to 2.0.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Support Board: Does not have any CSRF checks in actions handled by the include/ajaxCVE-2021-24823 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files
- Product
- Support Board
- Fixed in
- 3.3.6
- What to do
- Update Support Board to 3.3.6 or newer.
Full record and what to do →NVD recordnoob3xploiter.medium.comwpscan.com
Feb 28, 2022Cost Calculator: Allows authenticated users (Contributor+ in versions < 1CVE-2021-24820 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout
- Product
- Cost Calculator
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX actionCVE-2021-24730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.
- Product
- Logo Showcase with Slick Slider
- Fixed in
- 1.2.5
- What to do
- Update Logo Showcase with Slick Slider to 1.2.5 or newer.
Feb 28, 2022In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unCVE-2021-24704 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
- Product
- Orange Form
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022Orange Form: Does not have any authorisation and CSRF checks in all of its AJAX callsCVE-2021-24688 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)
- Product
- Orange Form
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 202215Zine: Does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX actionCVE-2020-36510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- 15Zine
- Fixed in
- 3.3.0
- What to do
- Update 15Zine to 3.3.0 or newer.
Feb 24, 2022WP Statistics: SQL InjectionCVE-2022-25149 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Feb 24, 2022WP Statistics: SQL InjectionCVE-2022-25148 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgist.github.com
Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 24, 2022WP Statistics: SQL InjectionCVE-2022-0651 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).CVE-2022-25599 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 21, 2022Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).CVE-2022-23984 · WordPress plugins & themes · reported by PatchstackLow 3.7
Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).
- Affected
- up to 7.3.11
- What to do
- Affects up to 7.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (veCVE-2022-23983 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 21, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).CVE-2021-26256 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 21, 2022Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro: Do not sanitise and escape the html_element_selection parameter before outputting it back in the pageCVE-2022-0288 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro
- Fixed in
- 2.7.10
- What to do
- Update Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro to 2.7.10 or newer.
Feb 21, 2022AnyComment: Is affected by a race conditionCVE-2022-0279 · WordPress plugins & themes · reported by WPScanLow 3.1
The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Feb 21, 2022WOOCS: Does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the respCVE-2022-0234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- WOOCS
- Fixed in
- 1.3.7.5
- What to do
- Update WOOCS to 1.3.7.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Coming soon and Maintenance mode: Does not have CSRF check in its coming_soon_send_mail AJAX actionCVE-2022-0199 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.6.8
- What to do
- Update Coming soon and Maintenance mode to 3.6.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Image Photo Gallery Final Tiles Grid: Does not sanitise and escape the Description fieldCVE-2022-0186 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.5.3
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.5.3 or newer.
Feb 21, 2022Coming soon and Maintenance mode: Does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX actionCVE-2022-0164 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.5.3
- What to do
- Update Coming soon and Maintenance mode to 3.5.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022GiveWP: Does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX actionCVE-2021-25099 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Duplicate Page or Post: Does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX actionCVE-2021-25075 · WordPress plugins & themes · reported by WPScanLow 3.5
The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues
- Product
- Duplicate Page or Post
- Fixed in
- 1.5.1
- What to do
- Update Duplicate Page or Post to 1.5.1 or newer.
Feb 21, 2022Five Star Business Profile and Schema: Does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX actionCVE-2021-25060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues
- Product
- Five Star Business Profile and Schema
- Fixed in
- 2.1.7
- What to do
- Update Five Star Business Profile and Schema to 2.1.7 or newer.
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
- Product
- Buffer Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
- Product
- Translation Exchange
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2022The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.CVE-2022-23982 · WordPress plugins & themes · reported by PatchstackMedium 4.3
The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 18, 2022The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).CVE-2022-23981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts.CVE-2022-24665 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to editCVE-2022-24664 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated userCVE-2022-24663 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated user.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 16, 2022WP Statistics: SQL InjectionCVE-2022-0513 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.
- Product
- WP Statistics
- Affected
- up to 13.1.4
- What to do
- Affects up to 13.1.4. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 16, 2022Fancy Product Designer: SQL InjectionCVE-2021-4134 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.
- Product
- Fancy Product Designer
- Affected
- up to 4.7.4
- What to do
- Affects up to 4.7.4. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com
Feb 14, 2022SpiderCalendar: Does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0212 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
- Product
- SpiderCalendar
- Affected
- up to 1.5.65
- What to do
- Affects up to 1.5.65. Update SpiderCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2022Ad Invalid Click Protector (AICP): Is affected by a SQL Injection in the id parameter of the delete actionCVE-2022-0190 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action.
- Product
- Ad Invalid Click Protector (AICP)
- Fixed in
- 1.2.6
- What to do
- Update Ad Invalid Click Protector (AICP) to 1.2.6 or newer.
Feb 14, 2022Futurio Extra: Is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the databaseCVE-2021-25109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
- Product
- Futurio Extra
- Fixed in
- 1.6.3
- What to do
- Update Futurio Extra to 1.6.3 or newer.
Feb 14, 2022PPOM for WooCommerce: Does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX actionCVE-2021-25018 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
- Product
- PPOM for WooCommerce
- Fixed in
- 24.0
- What to do
- Update PPOM for WooCommerce to 24.0 or newer.
Feb 14, 2022Ibtana: Does not have authorisation and CSRF checks in the ive_save_general_settings AJAX actionCVE-2021-25014 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.
- Product
- Ibtana
- Fixed in
- 1.1.4.9
- What to do
- Update Ibtana to 1.1.4.9 or newer.
Feb 14, 2022Mortgage Calculators WP: Does not implement any sanitisation on the color setting of the background of a calculatorCVE-2021-24904 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Mortgage Calculators WP
- Fixed in
- 1.56
- What to do
- Update Mortgage Calculators WP to 1.56 or newer.
Feb 7, 2022IP2Location Country Blocker: Does not have CSRF check in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25108 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.6
- What to do
- Update IP2Location Country Blocker to 2.26.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages: Does not check for authorisation and has a flawed CSRF logicCVE-2021-25106 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting
- Product
- Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages
- Fixed in
- 2.7.1
- What to do
- Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages to 2.7.1 or newer.
Feb 7, 2022The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URLCVE-2021-25096 · WordPress plugins & themes · reported by WPScanMedium 6.5
The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.5
- What to do
- Update IP2Location Country Blocker to 2.26.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022IP2Location Country Blocker: Does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25095 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.5
- What to do
- Update IP2Location Country Blocker to 2.26.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Ultimate Product Catalog: Does not have authorisation and CSRF checks in some AJAX actionsCVE-2021-24993 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
- Product
- Ultimate Product Catalog
- Fixed in
- 5.0.26
- What to do
- Update Ultimate Product Catalog to 5.0.26 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022RVM: Does not have proper authorisationCVE-2021-24947 · WordPress plugins & themes · reported by WPScanMedium 6.5
The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server
- Product
- RVM
- Fixed in
- 6.4.2
- What to do
- Update RVM to 6.4.2 or newer.
Feb 7, 2022Rearrange Woocommerce Products: Does not have proper access controls in the save_all_order AJAX actionCVE-2021-24928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.
- Product
- Rearrange Woocommerce Products
- Fixed in
- 3.0.8
- What to do
- Update Rearrange Woocommerce Products to 3.0.8 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.