Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,771 results · page 471 of 496
May 24, 2021dsgvoaio_write_log AJAX action of the DSGVO All in one for WP: Did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/adminCVE-2021-24294 · WordPress plugins & themes · reported by WPScanMedium 6.1
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
- Product
- dsgvoaio_write_log AJAX action of the DSGVO All in one for WP
- Fixed in
- 4.0
- What to do
- Update dsgvoaio_write_log AJAX action of the DSGVO All in one for WP to 4.0 or newer.
May 17, 2021SEO Redirection Plugin – 301 Redirect Manager: Did not sanitise the Redirect From and Redirect To fieldsCVE-2021-24327 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads
- Product
- SEO Redirection Plugin – 301 Redirect Manager
- Fixed in
- 6.4
- What to do
- Update SEO Redirection Plugin – 301 Redirect Manager to 6.4 or newer.
May 17, 2021tab parameter of the settings page of the 404 SEO Redirection: Is vulnerable to a reflected Cross-Site Scripting (XSS) issueCVE-2021-24325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or escaped before being output in an attribute.
- Product
- tab parameter of the settings page of the 404 SEO Redirection
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update tab parameter of the settings page of the 404 SEO Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2021404 SEO Redirection: Is lacking CSRF checks in all its settingsCVE-2021-24324 · WordPress plugins & themes · reported by WPScanMedium 6.5
The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues
- Product
- 404 SEO Redirection
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update 404 SEO Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2021When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high CVE-2021-24323 · WordPress plugins & themes · reported by WPScanMedium 4.8
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
- Fixed in
- 5.2.0
- What to do
- Update the plugin to 5.2.0 or newer.
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.4
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
May 17, 2021ReDi Restaurant Reservation: Provides the functionality to let users make restaurant reservationsCVE-2021-24299 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.
- Product
- ReDi Restaurant Reservation
- Fixed in
- 21.0426
- What to do
- Update ReDi Restaurant Reservation to 21.0426 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 17, 2021It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress PluCVE-2021-24295 · WordPress plugins & themes · reported by WPScanHigh 7.5
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
- Product
- Spam protection, AntiSpam, FireWall by CleanTalk
- Fixed in
- 5.153.4
- What to do
- Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.153.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 17, 2021There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta datCVE-2021-24289 · WordPress plugins & themes · reported by WPScanHigh 8.8
There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
- Product
- Store Locator Plus for
- Affected
- up to 5.5.14
- What to do
- Affects up to 5.5.14. Update Store Locator Plus for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021Kaswara Modern VC Addons: Allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX actionCVE-2021-24284 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
- Product
- Kaswara Modern VC Addons
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Kaswara Modern VC Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comcodecanyon.net
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the pluCVE-2021-24282 · WordPress plugins & themes · reported by WPScanMedium 6.3
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action CVE-2021-24281 · WordPress plugins & themes · reported by WPScanMedium 4.3
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action to delete any post on a target site.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action tCVE-2021-24280 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action to inject PHP objects.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to instalCVE-2021-24279 · WordPress plugins & themes · reported by WPScanMedium 6.5
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to install any plugin from the WordPress repository.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce foCVE-2021-24278 · WordPress plugins & themes · reported by WPScanHigh 7.5
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin beforeCVE-2021-24195 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Login as User or Customer (User Switching)
- Fixed in
- 1.8
- What to do
- Update Login as User or Customer (User Switching) to 1.8 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin beCVE-2021-24194 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Login Protection - Limit Failed Login Attempts
- Fixed in
- 2.9
- What to do
- Update Login Protection - Limit Failed Login Attempts to 2.9 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12,CVE-2021-24193 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Visitor Traffic Real Time Statistics
- Fixed in
- 2.12
- What to do
- Update Visitor Traffic Real Time Statistics to 2.12 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (iCVE-2021-24192 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Tree Sitemap
- Fixed in
- 2.9
- What to do
- Update Tree Sitemap to 2.9 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin befCVE-2021-24191 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- WP Maintenance Mode & Site Under Construction
- Fixed in
- 1.8.2
- What to do
- Update WP Maintenance Mode & Site Under Construction to 1.8.2 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1CVE-2021-24190 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- WooCommerce Conditional Marketing Mailer
- Fixed in
- 1.5.2
- What to do
- Update WooCommerce Conditional Marketing Mailer to 1.5.2 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress pluginCVE-2021-24189 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Captchinoo, Google recaptcha for admin login page
- Fixed in
- 2.4
- What to do
- Update Captchinoo, Google recaptcha for admin login page to 2.4 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin beforCVE-2021-24188 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- WP Content Copy Protection & No Right Click
- Fixed in
- 3.1.5
- What to do
- Update WP Content Copy Protection & No Right Click to 3.1.5 or newer.
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from lack of sanitisation in the label of the Form FieldsCVE-2021-24250 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in the label of the Form Fields, leading to Authenticated Stored Cross-Site Scripting issues across various pages of the plugin.
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11.2
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
May 6, 2021Contact Form Check Tester: Settings are visible to all registered users in the dashboard and are lacking any sanitisationCVE-2021-24247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
- Product
- Contact Form Check Tester
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Contact Form Check Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2021An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low prCVE-2021-24244 · WordPress plugins & themes · reported by WPScanMedium 6.5
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).
- Fixed in
- 4.5.8
- What to do
- Update the plugin to 4.5.8 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
May 6, 2021An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitizationCVE-2021-24243 · WordPress plugins & themes · reported by WPScanMedium 5.4
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.
- Fixed in
- 4.5.6
- What to do
- Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
May 5, 2021In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that thCVE-2021-24293 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.
- Product
- NextGEN Gallery Pro
- Fixed in
- 3.1.11
- What to do
- Update NextGEN Gallery Pro to 3.1.11 or newer.
May 5, 2021Contact Form by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24276 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Contact Form by Supsystic
- Fixed in
- 1.7.15
- What to do
- Update Contact Form by Supsystic to 1.7.15 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Popup by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24275 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Popup by Supsystic
- Fixed in
- 1.10.5
- What to do
- Update Popup by Supsystic to 1.10.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Ultimate Maps by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24274 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Ultimate Maps by Supsystic
- Fixed in
- 1.2.5
- What to do
- Update Ultimate Maps by Supsystic to 1.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Sina Extension for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24269 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- Sina Extension for Elementor
- Fixed in
- 3.3.12
- What to do
- Update Sina Extension for Elementor to 3.3.12 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021Rife Elementor Extensions & Templates: Has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24265 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- Rife Elementor Extensions & Templates
- Fixed in
- 1.1.6
- What to do
- Update Rife Elementor Extensions & Templates to 1.1.6 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHPCVE-2016-20010 · WordPress plugins & themes · reported by MITRECritical 10
EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5.
- Fixed in
- 2.8.5
- What to do
- Update the plugin to 2.8.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 27, 2021WP Fastest Cache versions prior to 0.9.1.7: Directory traversalCVE-2021-20714 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in WP Fastest Cache versions prior to 0.9.1.7 allows a remote attacker with administrator privileges to delete arbitrary files on the server via unspecified vectors.
- Product
- WP Fastest Cache versions prior to 0.9.1.7
- Fixed in
- 0.9.1.7
- What to do
- Update WP Fastest Cache versions prior to 0.9.1.7 to 0.9.1.7 or newer.
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · WordPress plugins & themes · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
- Product
- Tutor LMS – eLearning and online course solution
- Fixed in
- 1.8.8
- What to do
- Update Tutor LMS – eLearning and online course solution to 1.8.8 or newer.
Apr 22, 2021Business Hours Pro: Allows a remote attacker to upload arbitrary files using its manual update functionalityCVE-2021-24240 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.
- Product
- Business Hours Pro
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update Business Hours Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Apr 22, 2021Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments: Does not sanitise the invitaion_code GET parameterCVE-2021-24239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
- Product
- Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments
- Fixed in
- 3.7.0.1
- What to do
- Update Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments to 3.7.0.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 12, 2021The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin befoCVE-2021-24229 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
- Fixed in
- 1.7.2
- What to do
- Update the plugin to 1.7.2 or newer.
Apr 12, 2021The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in pCVE-2021-24224 · WordPress plugins & themes · reported by WPScanHigh 8.8
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
- Product
- Easy Form Builder
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 12, 2021wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for: Were vulnerable to CSRF due to a lack of nonce protectionCVE-2021-24218 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.
- Product
- wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for
- Fixed in
- 3.0.4
- What to do
- Update wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for to 3.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 12, 2021run_action function of the Facebook for: Deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerabilityCVE-2021-24217 · WordPress plugins & themes · reported by WPScanHigh 8.1
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
- Product
- run_action function of the Facebook for
- Fixed in
- 3.0.0
- What to do
- Update run_action function of the Facebook for to 3.0.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 12, 2021GiveWP – Donation Plugin and Fundraising Platform: Was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panelCVE-2021-24213 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.0
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.0 or newer.
Apr 12, 2021wpDataTables – Tables & Table Charts premium: Allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajaxCVE-2021-24200 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'length' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
- Product
- wpDataTables – Tables & Table Charts premium
- Fixed in
- 3.4.2
- What to do
- Update wpDataTables – Tables & Table Charts premium to 3.4.2 or newer.
Full record and what to do →NVD recordn4nj0.github.iowpdatatables.com
Apr 12, 2021wpDataTables – Tables & Table Charts premium: Allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajaxCVE-2021-24199 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
- Product
- wpDataTables – Tables & Table Charts premium
- Fixed in
- 3.4.2
- What to do
- Update wpDataTables – Tables & Table Charts premium to 3.4.2 or newer.
Full record and what to do →NVD recordn4nj0.github.iowpdatatables.com
Apr 9, 2021the Larsens Calender plugin Version <= 1.2 for: Cross Site Scripting (XSS)CVE-2020-23762 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote attackers to execute arbitrary web script via the "titel" column on the "Eintrage hinzufugen" tab.
- Product
- the Larsens Calender plugin Version <= 1.2 for
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the Larsens Calender plugin Version <= 1.2 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhidden-one.co.inwordpress.org
Apr 5, 2021WP Super Cache: Was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location optionCVE-2021-24209 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
- Product
- WP Super Cache
- Fixed in
- 1.7.2
- What to do
- Update WP Super Cache to 1.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter.CVE-2021-24204 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
- Product
- Elementor Website Builder
- Fixed in
- 3.1.4
- What to do
- Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021setting page of the SEO Redirection Plugin - 301 Redirect Manager: Is vulnerable to reflected Cross-Site Scripting (XSS)CVE-2021-24187 · WordPress plugins & themes · reported by WPScanMedium 5.4
The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute.
- Product
- setting page of the SEO Redirection Plugin - 301 Redirect Manager
- Fixed in
- 6.4
- What to do
- Update setting page of the SEO Redirection Plugin - 301 Redirect Manager to 6.4 or newer.
Apr 5, 2021tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24186 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
- Product
- tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution
- Fixed in
- 1.8.3
- What to do
- Update tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.