Updated 28 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

557new WordPress flaws this week

391,528entries in the database

3,187 results · page 61 of 64

Oct 18, 2021Podcast Subscribe Buttons: Allows users with any role capable of editing or adding posts to perform stored XSSCVE-2021-24743 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS.
Product
Podcast Subscribe Buttons
Fixed in
1.4.2
What to do
Update Podcast Subscribe Buttons to 1.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Tutor LMS: Does not escape some of its settings before outputting them in attributesCVE-2021-24740 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Tutor LMS
Fixed in
1.9.9
What to do
Update Tutor LMS to 1.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files: Does not sanitise and escape some of its settings before outputting them in attributesCVE-2021-24736 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.
Product
Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files
Fixed in
1.6.57
What to do
Update Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files to 1.6.57 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Compact WP Audio Player: Does not escape some of its shortcodes attributesCVE-2021-24734 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
Product
Compact WP Audio Player
Fixed in
1.9.7
What to do
Update Compact WP Audio Player to 1.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021PDF Flipbook, 3D Flipbook WordPress – DearFlip: Does not escape the class attribute of its shortcode before outputting it back in an attributeCVE-2021-24732 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
PDF Flipbook, 3D Flipbook WordPress – DearFlip
Fixed in
1.7.10
What to do
Update PDF Flipbook, 3D Flipbook WordPress – DearFlip to 1.7.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
Product
LearnPress
Fixed in
4.1.3.1
What to do
Update LearnPress to 4.1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021One User Avatar: Does not escape the link and target attributes of its shortcodeCVE-2021-24672 · WordPress plugins & themes · reported by WPScanMedium 5.4
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
One User Avatar
Fixed in
2.3.7
What to do
Update One User Avatar to 2.3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Customer Service Software & Support Ticket System: Does not sanitize or escape form fields before outputting it in the ListCVE-2021-24622 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Customer Service Software & Support Ticket System
Fixed in
5.10.4
What to do
Update Customer Service Software & Support Ticket System to 5.10.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021GamePress: Does not escape the op_edit POST parameter before outputting it back in multiple Game Option pagesCVE-2021-24617 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues
Product
GamePress
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update GamePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Wechat Reward: Does not sanitise or escape its QR settingsCVE-2021-24615 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.
Product
Wechat Reward
Affected
up to 1.7
What to do
Affects up to 1.7. Update Wechat Reward to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Sociable: Does not sanitise or escape some of its settings before outputting them in the admins dashboardCVE-2021-24612 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed
Product
Sociable
Affected
up to 4.3.4.1
What to do
Affects up to 4.3.4.1. Update Sociable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021PlanSo Forms: Does not escape the title of its Form before outputting it in attributesCVE-2021-24516 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
Product
PlanSo Forms
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update PlanSo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Comments – wpDiscuz: Does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the pageCVE-2021-24737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Comments – wpDiscuz
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Weather Effect: Does not properly validate and escape some of its settings (like *_size_leafCVE-2021-24709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which could lead to Stored Cross-Site Scripting issues
Product
Weather Effect
Fixed in
1.3.6
What to do
Update Weather Effect to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Quiz And Survey Master: Does not escape the Quiz Url Slug setting before outputting it in some pagesCVE-2021-24691 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Quiz And Survey Master
Fixed in
7.3.2
What to do
Update Quiz And Survey Master to 7.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Chained Quiz: Does not properly sanitize or escape inputs in the plugin's settingsCVE-2021-24690 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings.
Product
Chained Quiz
Fixed in
1.2.7.2
What to do
Update Chained Quiz to 1.2.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Duplicate Page: Does not sanitise or escape the Duplicate Post Suffix settings before outputting itCVE-2021-24681 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Duplicate Page
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Duplicate Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Simple Social Media Share Buttons: Does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used)CVE-2021-24656 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Simple Social Media Share Buttons
Fixed in
3.2.4
What to do
Update Simple Social Media Share Buttons to 3.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.pCVE-2021-39347 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
Affected
3.0.0 to 3.3.9
What to do
Affects 3.0.0 to 3.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Modern Events Calendar Lite
Fixed in
5.22.2
What to do
Update Modern Events Calendar Lite to 5.22.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021Bitcoin / AltCoin Payment Gateway for WooCommerce: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
Product
Bitcoin / AltCoin Payment Gateway for WooCommerce
Fixed in
1.6.1
What to do
Update Bitcoin / AltCoin Payment Gateway for WooCommerce to 1.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021CM Tooltip Glossary: Does not escape some glossary_tooltip shortcode attributesCVE-2021-24678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
CM Tooltip Glossary
Fixed in
3.9.21
What to do
Update CM Tooltip Glossary to 3.9.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021Better Find and Replace: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24676 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
Product
Better Find and Replace
Fixed in
1.2.9
What to do
Update Better Find and Replace to 1.2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021Appointment Hour Booking: Does not escape some of the Calendar Form settingsCVE-2021-24673 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Appointment Hour Booking
Fixed in
1.3.16
What to do
Update Appointment Hour Booking to 1.3.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021MX Time Zone Clocks: Does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcodeCVE-2021-24671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
MX Time Zone Clocks
Fixed in
3.4.1
What to do
Update MX Time Zone Clocks to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021CoolClock: Does not escape some shortcode attributesCVE-2021-24670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks
Product
CoolClock
Fixed in
4.3.5
What to do
Update CoolClock to 4.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021WP Map Block: Does not escape some attributes of the WP Map BlockCVE-2021-24643 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Product
WP Map Block
Fixed in
1.2.3
What to do
Update WP Map Block to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not properly sanitise or escape some of the properties of the Recipe Card Block (suchCVE-2021-24634 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
Product
Recipe Card Blocks by WPZOOM
Fixed in
2.8.3
What to do
Update Recipe Card Blocks by WPZOOM to 2.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not escape the message parameter before outputting it back in the admin dashboardCVE-2021-24632 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Recipe Card Blocks by WPZOOM
Fixed in
2.8.1
What to do
Update Recipe Card Blocks by WPZOOM to 2.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021Cookie Notice & Compliance for GDPR / CCPA: Does not escape the value of its Button Text settingCVE-2021-24569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfiltered_html capability is disallowed.
Product
Cookie Notice & Compliance for GDPR / CCPA
Fixed in
2.1.2
What to do
Update Cookie Notice & Compliance for GDPR / CCPA to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Support Board: Does not escape multiple POST parameters (suchCVE-2021-24741 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
Product
Support Board
Fixed in
3.3.4
What to do
Update Support Board to 3.3.4 or newer.
Full record and what to do →NVD record board.support medium.com
Sep 20, 2021Limit Login Attempts: Does not escape the IP addresses (which can be controlled by attacker via headers suchCVE-2021-24657 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
Product
Limit Login Attempts
Fixed in
4.0.50
What to do
Update Limit Login Attempts to 4.0.50 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as lCVE-2021-24640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
WordPress Slider Block Gutenslider
Fixed in
5.2.0
What to do
Update WordPress Slider Block Gutenslider to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021OMGF: Does not escape or validate the handle parameter of the REST APICVE-2021-24638 · WordPress plugins & themes · reported by WPScanCritical 9.1
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
Product
OMGF
Fixed in
4.5.4
What to do
Update OMGF to 4.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Google Fonts Typography: Does not escape and sanitise some of its block settingsCVE-2021-24637 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
Product
Google Fonts Typography
Fixed in
3.0.3
What to do
Update Google Fonts Typography to 3.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Donate With QRCode: Does not sanitise or escape its QRCode Image settingCVE-2021-24618 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.
Product
Donate With QRCode
Fixed in
1.4.5
What to do
Update Donate With QRCode to 1.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Post Views Counter: Does not sanitise or escape its Post Views Label settingsCVE-2021-24613 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
Product
Post Views Counter
Fixed in
1.3.5
What to do
Update Post Views Counter to 1.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021WP Mapa Politico Espana: Does not sanitise or escape some of its settings before outputting them in attributesCVE-2021-24609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
WP Mapa Politico Espana
Fixed in
3.7.0
What to do
Update WP Mapa Politico Espana to 3.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Availability Calendar: Does not escape the category attribute from its shortcode before using it in a SQL statementCVE-2021-24606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
Product
Availability Calendar
Fixed in
1.2.1
What to do
Update Availability Calendar to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Availability Calendar: Does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embedCVE-2021-24604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Availability Calendar
Fixed in
1.2.2
What to do
Update Availability Calendar to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021WP Dialog: Does not sanitise and escape some of its settings before outputting them in pagesCVE-2021-24600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WP Dialog
Affected
up to 1.2.5.5
What to do
Affects up to 1.2.5.5. Update WP Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021You Shang: Does not escape its qrcode links settingsCVE-2021-24597 · WordPress plugins & themes · reported by WPScanMedium 5.4
The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used
Product
You Shang
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update You Shang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021youForms for: Does not sanitise escape the Button Text field of its TemplatesCVE-2021-24596 · WordPress plugins & themes · reported by WPScanMedium 4.8
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
youForms for
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update youForms for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Splash Header: Doesn't sanitise and escape some of its settings while outputting them in the admin dashboardCVE-2021-24587 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.
Product
Splash Header
Fixed in
1.20.8
What to do
Update Splash Header to 1.20.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021ThinkTwit: Did not sanitise or escape its "Consumer key" setting before outputting it its settings pageCVE-2021-24582 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it its settings page, leading to a Stored Cross-Site Scripting issue.
Product
ThinkTwit
Fixed in
1.7.1
What to do
Update ThinkTwit to 1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before insertinCVE-2021-24403 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
Product
Orders functionality in the WordPress Page Contact
Affected
up to 1.0
What to do
Affects up to 1.0. Update Orders functionality in the WordPress Page Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 20, 2021A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statemeCVE-2021-24396 · WordPress plugins & themes · reported by WPScanHigh 7.2
A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
GSEOR – WordPress SEO
Affected
up to 1.3
What to do
Affects up to 1.3. Update GSEOR – WordPress SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 13, 2021StopBadBots: Did not validate or escape the order and orderby GET parameter in some of its admin dashboard pagesCVE-2021-24727 · WordPress plugins & themes · reported by WPScanHigh 8.8
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
Product
StopBadBots
Fixed in
6.60
What to do
Update StopBadBots to 6.60 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Sep 13, 2021WP Simple Booking Calendar: Did not escapeCVE-2021-24726 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue
Product
WP Simple Booking Calendar
Fixed in
2.0.6
What to do
Update WP Simple Booking Calendar to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com trustwave.com
Sep 13, 2021WordPress Advanced Ticket System, Elite Support Helpdesk: Does not sanitize or escape form values before saving to the database orCVE-2021-24623 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WordPress Advanced Ticket System, Elite Support Helpdesk
Fixed in
1.0.64
What to do
Update WordPress Advanced Ticket System, Elite Support Helpdesk to 1.0.64 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.