Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

570new WordPress flaws this week

391,397entries in the database

3,187 results · page 58 of 64

Jan 10, 2022WP Search Filters" widget of The Plus Addons for Elementor - Pro: Does not sanitise and escape the option parameter before using it in a SQL statementCVE-2021-24949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection
Product
WP Search Filters" widget of The Plus Addons for Elementor - Pro
Fixed in
5.0.7
What to do
Update WP Search Filters" widget of The Plus Addons for Elementor - Pro to 5.0.7 or newer.
Full record and what to do →NVD record roadmap.theplusaddons.com wpscan.com
Jan 10, 2022RegistrationMagic: Does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statementCVE-2021-24862 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
Product
RegistrationMagic
Fixed in
5.0.1.6
What to do
Update RegistrationMagic to 5.0.1.6 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jan 3, 2022Booking Calendar: Does not sanitise and escape the booking_type parameter before outputting it back in an admin pageCVE-2021-25040 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Booking Calendar
Fixed in
8.9.2
What to do
Update Booking Calendar to 8.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Events Made Easy: Does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX actionCVE-2021-25030 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks
Product
Events Made Easy
Fixed in
2.2.36
What to do
Update Events Made Easy to 2.2.36 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022PowerPack Addons for Elementor: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-25027 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
PowerPack Addons for Elementor
Fixed in
2.6.2
What to do
Update PowerPack Addons for Elementor to 2.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022Speed Booster Pack ⚡ PageSpeed Optimization Suite: Does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related tableCVE-2021-25023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection
Product
Speed Booster Pack ⚡ PageSpeed Optimization Suite
Fixed in
4.3.3.1
What to do
Update Speed Booster Pack ⚡ PageSpeed Optimization Suite to 4.3.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pagesCVE-2021-25022 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
Product
UpdraftPlus WordPress Backup
Fixed in
1.16.66
What to do
Update UpdraftPlus WordPress Backup to 1.16.66 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboardCVE-2021-25001 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue
Product
Booster for WooCommerce
Fixed in
5.4.9
What to do
Update Booster for WooCommerce to 5.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboardCVE-2021-25000 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue
Product
Booster for WooCommerce
Fixed in
5.4.9
What to do
Update Booster for WooCommerce to 5.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboardCVE-2021-24999 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting
Product
Booster for WooCommerce
Fixed in
5.4.9
What to do
Update Booster for WooCommerce to 5.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022WooCommerce PDF Invoices & Packing Slips: Does not escape the tab and section parameters before outputting it back in an attributeCVE-2021-24991 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard
Product
WooCommerce PDF Invoices & Packing Slips
Fixed in
2.10.5
What to do
Update WooCommerce PDF Invoices & Packing Slips to 2.10.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Site Reviews: Does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users)CVE-2021-24973 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
Product
Site Reviews
Fixed in
5.17.3
What to do
Update Site Reviews to 5.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022LiteSpeed Cache: Does not escape the qc_res parameter before outputting it back in the JS code of an admin pageCVE-2021-24963 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting
Product
LiteSpeed Cache
Fixed in
4.4.4
What to do
Update LiteSpeed Cache to 4.4.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022Mortgage Calculator / Loan Calculator: Does not escape the some of the attributes of its mlcalc shortcode before outputting themCVE-2021-24828 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
Mortgage Calculator / Loan Calculator
Fixed in
1.5.17
What to do
Update Mortgage Calculator / Loan Calculator to 1.5.17 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Download Monitor: Does not properly validate and escape the "orderby" GET parameter before using it in a SQL statementCVE-2021-24786 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
Product
Download Monitor
Fixed in
4.4.5
What to do
Update Download Monitor to 4.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022WP Travel Engine: Does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pagesCVE-2021-24680 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
Product
WP Travel Engine
Fixed in
5.3.1
What to do
Update WP Travel Engine to 5.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Smart Floating / Sticky Buttons: Does not sanitise and escape some parameter before outputting them in attributes and pageCVE-2021-24992 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Smart Floating / Sticky Buttons
Fixed in
2.5.5
What to do
Update Smart Floating / Sticky Buttons to 2.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021WP RSS Aggregator: Does not sanitise and escape data before outputting it in the System Info admin dashboardCVE-2021-24988 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.
Product
WP RSS Aggregator
Fixed in
4.19.3
What to do
Update WP RSS Aggregator to 4.19.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021WPFront User Role Editor: Does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboardCVE-2021-24984 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
Product
WPFront User Role Editor
Fixed in
3.2.1.11184
What to do
Update WPFront User Role Editor to 3.2.1.11184 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Gwolle Guestbook: Does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attributeCVE-2021-24980 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page
Product
Gwolle Guestbook
Fixed in
4.2.0
What to do
Update Gwolle Guestbook to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Paid Memberships Pro: Does not escape the s parameter before outputting it back in an attribute in an admin pageCVE-2021-24979 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Paid Memberships Pro
Fixed in
2.6.6
What to do
Update Paid Memberships Pro to 2.6.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 27, 2021WordPress Download Manager: Does not sanitise and escape Template data before outputting it in various pages (suchCVE-2021-24969 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
Product
WordPress Download Manager
Fixed in
3.2.22
What to do
Update WordPress Download Manager to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Contact Form & Lead Form Elementor Builder: Does not sanitise and escape some lead valuesCVE-2021-24967 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
Product
Contact Form & Lead Form Elementor Builder
Fixed in
1.6.4
What to do
Update Contact Form & Lead Form Elementor Builder to 1.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Typebot | Build beautiful conversational forms: Does not sanitise and escape the Publish ID settingCVE-2021-24902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Typebot | Build beautiful conversational forms
Fixed in
1.4.3
What to do
Update Typebot | Build beautiful conversational forms to 1.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
Product
Tickera
Fixed in
3.4.8.3
What to do
Update Tickera to 3.4.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021Blog2Social: Social Media Auto Post & Scheduler: Does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin pageCVE-2021-24956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
Blog2Social: Social Media Auto Post & Scheduler
Fixed in
6.8.7
What to do
Update Blog2Social: Social Media Auto Post & Scheduler to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021Popups, Welcome Bar, Optins and Lead Generation: Does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attributeCVE-2021-24941 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue
Product
Popups, Welcome Bar, Optins and Lead Generation
Fixed in
2.0.5
What to do
Update Popups, Welcome Bar, Optins and Lead Generation to 2.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021Contact Form, Drag and Drop Form Builder for: Does not escape the status parameter before outputting it back in an attributeCVE-2021-24907 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
Contact Form, Drag and Drop Form Builder for
Fixed in
1.8.0
What to do
Update Contact Form, Drag and Drop Form Builder for to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021WP Visitor Statistics (Real Time Traffic): Does not properly sanitise and escape the refUrl in the refDetails AJAX actionCVE-2021-24750 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
4.8
What to do
Update WP Visitor Statistics (Real Time Traffic) to 4.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Dec 21, 2021Logo Carousel: Does not validate and escape the "Logo Margin" carousel optionCVE-2021-24738 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
Logo Carousel
Fixed in
3.4.2
What to do
Update Logo Carousel to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021SportsPress: Does not sanitise and escape its match_day parameter before outputting back in the Events backend pageCVE-2021-24578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue
Product
SportsPress
Fixed in
2.7.9
What to do
Update SportsPress to 2.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Pixel Cat: Does not escape some of its settingsCVE-2021-24972 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Pixel Cat
Fixed in
2.6.3
What to do
Update Pixel Cat to 2.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX actionCVE-2021-24946 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
Product
Modern Events Calendar Lite
Fixed in
6.1.5
What to do
Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Dec 13, 2021Auto Featured Image (Auto Post Thumbnail): Does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS blockCVE-2021-24932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue.
Product
Auto Featured Image (Auto Post Thumbnail)
Fixed in
3.9.3
What to do
Update Auto Featured Image (Auto Post Thumbnail) to 3.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
Modern Events Calendar Lite
Fixed in
6.1.5
What to do
Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Caldera Forms: Does not sanitise and escape the Form Name before outputting it in attributesCVE-2021-24896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Caldera Forms
Fixed in
1.9.5
What to do
Update Caldera Forms to 1.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Get Custom Field Values: Does not escape custom fields before outputting them in the pageCVE-2021-24871 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
Get Custom Field Values
Fixed in
4.0.1
What to do
Update Get Custom Field Values to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots: Does not sanitise and escape the User Agent before using it in a SQL statement to save itCVE-2021-24863 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection
Product
WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots
Fixed in
6.67
What to do
Update WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots to 6.67 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Quotes Collection: Does not validate and escape the bulkcheck parameter before using it in a SQL statementCVE-2021-24861 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement, leading to a SQL injection
Product
Quotes Collection
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Quotes Collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Ultimate NoFollow: Does not sanitise and escape the href attribute of its shortcodesCVE-2021-24817 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
Ultimate NoFollow
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Ultimate NoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Flex Local Fonts: Does not escape the Class Name fieldCVE-2021-24782 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Flex Local Fonts
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Flex Local Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Inspirational Quote Rotator: Does not sanitize and escape some of its quote fieldsCVE-2021-24771 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when the unfiltered_html capability is disallowed
Product
Inspirational Quote Rotator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Inspirational Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021Registrations for the Events Calendar: Does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2021-24943 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
Product
Registrations for the Events Calendar
Fixed in
2.7.6
What to do
Update Registrations for the Events Calendar to 2.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021LoginWP (Formerly Peter's Login Redirect): Does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin pageCVE-2021-24939 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
LoginWP (Formerly Peter's Login Redirect)
Fixed in
3.0.0.5
What to do
Update LoginWP (Formerly Peter's Login Redirect) to 3.0.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WOOCS: Does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24938 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue
Product
WOOCS
Fixed in
1.3.7.1
What to do
Update WOOCS to 1.3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WP Google Fonts: Does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributesCVE-2021-24935 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues
Product
WP Google Fonts
Fixed in
3.1.5
What to do
Update WP Google Fonts to 3.1.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021Secure Copy Content Protection and Content Locking: Does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SCVE-2021-24931 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.
Product
Secure Copy Content Protection and Content Locking
Fixed in
2.8.2
What to do
Update Secure Copy Content Protection and Content Locking to 2.8.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Dec 6, 2021WordPress Online Booking and Scheduling: Does not escape the Staff Full Name field before outputting it back in a pageCVE-2021-24930 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue
Product
WordPress Online Booking and Scheduling
Fixed in
20.3.1
What to do
Update WordPress Online Booking and Scheduling to 20.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.