Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

472new WordPress flaws this week

390,714entries in the database

376 results · page 5 of 8

Aug 23, 2021pspin_duplicate_post_save_as_new_post function of the Project Status: Does not sanitiseCVE-2021-24558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue
Product
pspin_duplicate_post_save_as_new_post function of the Project Status
Affected
up to 1.6
What to do
Affects up to 1.6. Update pspin_duplicate_post_save_as_new_post function of the Project Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, thereCVE-2021-24557 · WordPress plugins & themes · reported by WPScanHigh 7.2
The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement witCVE-2021-24555 · WordPress plugins & themes · reported by WPScanHigh 8.8
The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and capability check, making it available to any authenticated user.
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 16, 2021Video Posts Webcam Recorder: Has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videosCVE-2021-24512 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
Product
Video Posts Webcam Recorder
Fixed in
3.2.4
What to do
Update Video Posts Webcam Recorder to 3.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_reports() function in the Secure Copy Content Protection and Content Locking: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24484 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_reports() function in the Secure Copy Content Protection and Content Locking
Fixed in
2.6.7
What to do
Update get_reports() function in the Secure Copy Content Protection and Content Locking to 2.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24483 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker
Fixed in
3.2.1
What to do
Update get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24463 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel
Fixed in
2.5.0
What to do
Update get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_rCVE-2021-24462 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery
Fixed in
4.4.4
What to do
Update get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery to 4.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_faqs() function in the FAQ Builder AYS: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24461 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_faqs() function in the FAQ Builder AYS
Fixed in
1.3.6
What to do
Update get_faqs() function in the FAQ Builder AYS to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_fb_likeboxes() function in the Popup Like box – Page: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24460 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_fb_likeboxes() function in the Popup Like box – Page
Fixed in
3.5.3
What to do
Update get_fb_likeboxes() function in the Popup Like box – Page to 3.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_results() and get_items() functions in the Survey Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24459 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_results() and get_items() functions in the Survey Maker
Fixed in
1.5.6
What to do
Update get_results() and get_items() functions in the Survey Maker to 1.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_ays_popupboxes() and get_popup_categories() functions of the Popup box: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24458 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_ays_popupboxes() and get_popup_categories() functions of the Popup box
Fixed in
2.3.4
What to do
Update get_ays_popupboxes() and get_popup_categories() functions of the Popup box to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-atCVE-2021-24457 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Fixed in
1.1.8
What to do
Update the plugin to 1.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2021In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $CVE-2021-34630 · WordPress plugins & themes · reported by WordfenceMedium 5
In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jul 19, 2021WP Image Zoom: Did not validate its tab parameter before using it in the include_once() functionCVE-2021-24447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to a local file inclusion issue in the admin dashboard
Product
WP Image Zoom
Fixed in
1.47
What to do
Update WP Image Zoom to 1.47 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 7, 2021A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extCVE-2021-34627 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions CVE-2021-34626 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scriptCVE-2021-34625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 6, 2021Export Users With Meta: Did not escape the list of roles to export before using them in a SQL statement in the export functionalityCVE-2021-24451 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection.
Product
Export Users With Meta
Fixed in
0.6.5
What to do
Update Export Users With Meta to 0.6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021import_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirectsCVE-2021-24353 · WordPress plugins & themes · reported by WPScanHigh 8.8
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
Product
import_data function of the Simple 301 Redirects by BetterLinks
Fixed in
2.0.4
What to do
Update import_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 14, 2021export_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to export a site's redirectsCVE-2021-24352 · WordPress plugins & themes · reported by WPScanHigh 8.8
The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.
Product
export_data function of the Simple 301 Redirects by BetterLinks
Fixed in
2.0.4
What to do
Update export_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 14, 2021This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server.CVE-2021-24349 · WordPress plugins & themes · reported by WPScanMedium 6.1
This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameCVE-2021-24348 · WordPress plugins & themes · reported by WPScanHigh 7.2
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
Product
Side Menu – add fixed side buttons
Fixed in
3.1.5
What to do
Update Side Menu – add fixed side buttons to 3.1.5 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 14, 2021Stock in & out: Has a search functionalityCVE-2021-24346 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue
Product
Stock in & out
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Stock in & out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 7, 2021WP Statistics: Relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the queryCVE-2021-24340 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
Product
WP Statistics
Fixed in
13.0.8
What to do
Update WP Statistics to 13.0.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 1, 2021WP Prayer: Provides the functionality to store requested prayers/praises and list them on a WordPress websiteCVE-2021-24313 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.
Product
WP Prayer
Fixed in
1.6.2
What to do
Update WP Prayer to 1.6.2 or newer.
Full record and what to do →NVD record bastijnouwendijk.com wpscan.com
May 17, 2021ReDi Restaurant Reservation: Provides the functionality to let users make restaurant reservationsCVE-2021-24299 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.
Product
ReDi Restaurant Reservation
Fixed in
21.0426
What to do
Update ReDi Restaurant Reservation to 21.0426 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 17, 2021There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta datCVE-2021-24289 · WordPress plugins & themes · reported by WPScanHigh 8.8
There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
Product
Store Locator Plus for
Affected
up to 5.5.14
What to do
Affects up to 5.5.14. Update Store Locator Plus for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 22, 2021Business Hours Pro: Allows a remote attacker to upload arbitrary files using its manual update functionalityCVE-2021-24240 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.
Product
Business Hours Pro
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Business Hours Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wpscan.com
Apr 12, 2021run_action function of the Facebook for: Deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerabilityCVE-2021-24217 · WordPress plugins & themes · reported by WPScanHigh 8.1
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
Product
run_action function of the Facebook for
Fixed in
3.0.0
What to do
Update run_action function of the Facebook for to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24186 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021REST API endpoint get_users in the User Profile Picture: Returned more information than was required for its functionality to users with the upload_files capabilityCVE-2021-24170 · WordPress plugins & themes · reported by WPScanHigh 7.5
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
Product
REST API endpoint get_users in the User Profile Picture
Fixed in
2.5.0
What to do
Update REST API endpoint get_users in the User Profile Picture to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wtsCVE-2021-24167 · WordPress plugins & themes · reported by WPScanHigh 7.5
When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookup_WP_account.
Fixed in
1.4.1
What to do
Update the plugin to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality.CVE-2021-24158 · WordPress plugins & themes · reported by WPScanMedium 6.5
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for lower-level users, however, they can still supply the user_role parameter to update the default role for registration.
Fixed in
2.10.3
What to do
Update the plugin to 2.10.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Theme Editor: Did not validate the GET file parameter before passing it to the download_file() functionCVE-2021-24154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd
Product
Theme Editor
Fixed in
2.6
What to do
Update Theme Editor to 2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, CVE-2021-24132 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks.
Fixed in
1.2.36
What to do
Update the plugin to 1.2.36 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).CVE-2020-14206 · WordPress plugins & themes · reported by MITREMedium 6.1
The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org hooperlabs.xyz
Nov 2, 2020is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attaCVE-2020-28037 · WordPress plugins & themes · reported by MITRECritical 9.8
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record github.com lists.debian.org
Oct 27, 2020search functionality of the Greenmart theme 2.4.2: XSSCVE-2020-16140 · WordPress plugins & themes · reported by MITREMedium 6.1
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.
Product
search functionality of the Greenmart theme 2.4.2
Affected
2.4.2 to 2.4.2
What to do
Affects 2.4.2 to 2.4.2. Update search functionality of the Greenmart theme 2.4.2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com cybersecurityworks.com
Sep 30, 2020There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needCVE-2020-21524 · WordPress plugins & themes · reported by MITRECritical 9.1
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Sep 16, 2020A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions.CVE-2020-20406 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Sep 10, 2020Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticCVE-2020-5780 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.3
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.
Fixed in
4.5.6
What to do
Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD record tenable.com tenable.com
May 29, 2020The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/CVE-2020-12675 · WordPress plugins & themes · reported by MITREHigh 8.8
The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.
Product
mappress-google-maps-for-wordpress
Fixed in
2.54.6
What to do
Update mappress-google-maps-for-wordpress to 2.54.6 or newer.
Full record and what to do →NVD record blog.alertlogic.com wordpress.org
Apr 22, 2020The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leadinCVE-2020-12077 · WordPress plugins & themes · reported by MITREHigh 8.8
The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leading to remote code execution.
Product
mappress-google-maps-for-wordpress
Fixed in
2.53.9
What to do
Update mappress-google-maps-for-wordpress to 2.53.9 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.CVE-2019-17231 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
Product
includes/theme-functions.php in the OneTone
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.CVE-2019-17230 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
Product
includes/theme-functions.php in the OneTone
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Mar 9, 2020The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functionCVE-2020-10257 · WordPress plugins & themes · reported by MITRECritical 9.8
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Product
ThemeREX Addons
Fixed in
2020-03-09
What to do
Update ThemeREX Addons to 2020-03-09 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submittCVE-2020-9458 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 17, 2020Popup Builder plugin 2.2.8 through 2.6.7.6: SQL injection (in the sgImportPopups function in sg_popup_ajaxCVE-2020-9006 · WordPress plugins & themes · reported by MITRECritical 9.8
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)
Product
Popup Builder plugin 2.2.8 through 2.6.7.6
Affected
up to 2.6.7.6
What to do
Affects up to 2.6.7.6. Update Popup Builder plugin 2.2.8 through 2.6.7.6 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 13, 2020Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow CVE-2013-1401 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll.
Product
editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll
Affected
34.05 to 34.05
What to do
Affects 34.05 to 34.05. Update editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.