Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,631 results · page 65 of 73
Feb 28, 2022Support Board: Does not have any CSRF checks in actions handled by the include/ajaxCVE-2021-24823 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files
- Product
- Support Board
- Fixed in
- 3.3.6
- What to do
- Update Support Board to 3.3.6 or newer.
Full record and what to do →NVD recordnoob3xploiter.medium.comwpscan.com
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX actionCVE-2021-24730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.
- Product
- Logo Showcase with Slick Slider
- Fixed in
- 1.2.5
- What to do
- Update Logo Showcase with Slick Slider to 1.2.5 or newer.
Feb 28, 2022Orange Form: Does not have any authorisation and CSRF checks in all of its AJAX callsCVE-2021-24688 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)
- Product
- Orange Form
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).CVE-2022-25599 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (veCVE-2022-23983 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 21, 2022Float menu: Does not have CSRF check in placeCVE-2022-0313 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Float menu
- Fixed in
- 4.3.1
- What to do
- Update Float menu to 4.3.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Coming soon and Maintenance mode: Does not have CSRF check in its coming_soon_send_mail AJAX actionCVE-2022-0199 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.6.8
- What to do
- Update Coming soon and Maintenance mode to 3.6.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Coming soon and Maintenance mode: Does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX actionCVE-2022-0164 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.5.3
- What to do
- Update Coming soon and Maintenance mode to 3.5.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022AnyComment: Does not have CSRF checks in the Import and Revert HyperComments featuresCVE-2022-0134 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Feb 21, 2022Duplicate Page or Post: Does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX actionCVE-2021-25075 · WordPress plugins & themes · reported by WPScanLow 3.5
The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues
- Product
- Duplicate Page or Post
- Fixed in
- 1.5.1
- What to do
- Update Duplicate Page or Post to 1.5.1 or newer.
Feb 21, 2022Five Star Business Profile and Schema: Does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX actionCVE-2021-25060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues
- Product
- Five Star Business Profile and Schema
- Fixed in
- 2.1.7
- What to do
- Update Five Star Business Profile and Schema to 2.1.7 or newer.
Feb 14, 2022PPOM for WooCommerce: Does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX actionCVE-2021-25018 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
- Product
- PPOM for WooCommerce
- Fixed in
- 24.0
- What to do
- Update PPOM for WooCommerce to 24.0 or newer.
Feb 14, 2022Ibtana: Does not have authorisation and CSRF checks in the ive_save_general_settings AJAX actionCVE-2021-25014 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.
- Product
- Ibtana
- Fixed in
- 1.1.4.9
- What to do
- Update Ibtana to 1.1.4.9 or newer.
Feb 14, 2022Remove Footer Credit: Does not have CSRF check in placeCVE-2021-24446 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
- Product
- Remove Footer Credit
- Fixed in
- 1.0.6
- What to do
- Update Remove Footer Credit to 1.0.6 or newer.
Feb 7, 2022IP2Location Country Blocker: Does not have CSRF check in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25108 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.6
- What to do
- Update IP2Location Country Blocker to 2.26.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages: Does not check for authorisation and has a flawed CSRF logicCVE-2021-25106 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting
- Product
- Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages
- Fixed in
- 2.7.1
- What to do
- Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages to 2.7.1 or newer.
Feb 7, 2022IP2Location Country Blocker: Does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25095 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.5
- What to do
- Update IP2Location Country Blocker to 2.26.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Ultimate Product Catalog: Does not have authorisation and CSRF checks in some AJAX actionsCVE-2021-24993 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
- Product
- Ultimate Product Catalog
- Fixed in
- 5.0.26
- What to do
- Update Ultimate Product Catalog to 5.0.26 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022SupportCandy: Does not have CSRF check in the wpsc_tickets AJAX actionCVE-2021-24879 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.
- Product
- SupportCandy
- Fixed in
- 2.2.7
- What to do
- Update SupportCandy to 2.2.7 or newer.
Feb 7, 2022SupportCandy: Does not have authorisation and CSRF checks in its wpsc_tickets AJAX actionCVE-2021-24839 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
- Product
- SupportCandy
- Fixed in
- 2.2.5
- What to do
- Update SupportCandy to 2.2.5 or newer.
Feb 1, 2022LabTools: Does not have proper authorisation and CSRF check in placeCVE-2021-25097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
- Product
- LabTools
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update LabTools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2022Link Library: Does not have CSRF checkCVE-2021-25092 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack
- Product
- Link Library
- Fixed in
- 7.2.8
- What to do
- Update Link Library to 7.2.8 or newer.
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not have CSRF check in placeCVE-2021-25072 · WordPress plugins & themes · reported by WPScanMedium 6.5
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.25
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.25 or newer.
Feb 1, 2022Perfect Survey: Does not have proper authorisation nor CSRF checks in the save_global_setting AJAX actionCVE-2021-24763 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey
- Product
- Perfect Survey
- Fixed in
- 1.5.2
- What to do
- Update Perfect Survey to 1.5.2 or newer.
Jan 24, 2022WP125: Does not have CSRF checks in various actionCVE-2021-25073 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack
- Product
- WP125
- Fixed in
- 1.5.5
- What to do
- Update WP125 to 1.5.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Qubely: Does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX actionCVE-2021-25013 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts
- Product
- Qubely
- Fixed in
- 1.7.8
- What to do
- Update Qubely to 1.7.8 or newer.
Jan 24, 2022Accept Donations with PayPal: Does not have CSRF check in place and does not ensure that the post to be deleted belongs to the pluginCVE-2021-24989 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.4
- What to do
- Update Accept Donations with PayPal to 1.3.4 or newer.
Jan 24, 2022Product Feed PRO for WooCommerce: Does not have authorisation and CSRF check in some of its AJAX actionsCVE-2021-24974 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.
- Product
- Product Feed PRO for WooCommerce
- Fixed in
- 11.0.7
- What to do
- Update Product Feed PRO for WooCommerce to 11.0.7 or newer.
Jan 24, 2022Ultimate FAQ: Does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actionsCVE-2021-24968 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
- Product
- Ultimate FAQ
- Fixed in
- 2.1.2
- What to do
- Update Ultimate FAQ to 2.1.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Five Star Restaurant Reservations: Does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX actionCVE-2021-24965 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it. Due to the lack of sanitisation and escaping, users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.4.8
- What to do
- Update Five Star Restaurant Reservations to 2.4.8 or newer.
Jan 24, 2022WP Extra File Types: Does not have CSRF checkCVE-2021-24936 · WordPress plugins & themes · reported by WPScanHigh 8
The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
- Product
- WP Extra File Types
- Fixed in
- 0.5.1
- What to do
- Update WP Extra File Types to 0.5.1 or newer.
Jan 19, 2022Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.CVE-2021-44777 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).
- Affected
- up to 5.2.6
- What to do
- Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jan 17, 2022EventCalendar: Does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actionsCVE-2021-25025 · WordPress plugins & themes · reported by WPScanMedium 4.3
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
- Product
- EventCalendar
- Fixed in
- 1.1.51
- What to do
- Update EventCalendar to 1.1.51 or newer.
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Cross-site request forgery (CSRF)CVE-2022-0180 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.
- Product
- Quiz And Survey Master versions prior to 7.3.7
- Fixed in
- 7.3.7
- What to do
- Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD recordjvn.jpquizandsurveymaster.com
Jan 13, 2022Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.CVE-2021-23227 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 10, 2022PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro: Does not have authorisation and CSRF checksCVE-2021-25032 · WordPress plugins & themes · reported by WPScanCritical 9.8
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.
- Product
- PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro
- Fixed in
- 2.3.1
- What to do
- Update PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro to 2.3.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 22, 2021Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).CVE-2021-36886 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).
- Affected
- up to 1.2.5.9
- What to do
- Affects up to 1.2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 20, 2021Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugCVE-2021-36887 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 13, 2021Like Button Rating ♥ LikeBtn: Does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX actionCVE-2021-24945 · WordPress plugins & themes · reported by WPScanHigh 8
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.
- Product
- Like Button Rating ♥ LikeBtn
- Fixed in
- 2.6.38
- What to do
- Update Like Button Rating ♥ LikeBtn to 2.6.38 or newer.
Dec 13, 2021Pixel Cat: Does not have CSRF checkCVE-2021-24922 · WordPress plugins & themes · reported by WPScanCritical 9
The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks
- Product
- Pixel Cat
- Fixed in
- 2.6.2
- What to do
- Update Pixel Cat to 2.6.2 or newer.
Dec 13, 2021Temporary Login Without Password: Does not have authorisation and CSRF checksCVE-2021-24836 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
- Product
- Temporary Login Without Password
- Fixed in
- 1.7.1
- What to do
- Update Temporary Login Without Password to 1.7.1 or newer.
Dec 13, 2021WP Limits: Does not have CSRF checkCVE-2021-24818 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values
- Product
- WP Limits
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Limits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Filter Portfolio Gallery: Is lacking Cross-Site Request Forgery (CSRF) checkCVE-2021-24795 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.
- Product
- Filter Portfolio Gallery
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Filter Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Shiny Buttons: Does not have any authorisation and CSRF in placeCVE-2021-24792 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.
- Product
- Shiny Buttons
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Shiny Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021WP Admin Logo Changer: Does not have CSRF checkCVE-2021-24784 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack.
- Product
- WP Admin Logo Changer
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Admin Logo Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Single Post Exporter: Does not have CSRF checksCVE-2021-24780 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page (such as private and password protected) via a direct URL
- Product
- Single Post Exporter
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Single Post Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021NEX-Forms: Does not have CSRF checks in placeCVE-2021-24705 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them
- Product
- NEX-Forms
- Fixed in
- 8.4.3
- What to do
- Update NEX-Forms to 8.4.3 or newer.
Dec 6, 2021Tawk.To Live Chat: Does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actionsCVE-2021-24914 · WordPress plugins & themes · reported by WPScanHigh 8
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.
- Product
- Tawk.To Live Chat
- Fixed in
- 0.6.0
- What to do
- Update Tawk.To Live Chat to 0.6.0 or newer.
Dec 2, 2021ClickBank Affiliate Ads: Does not have CSRF checkCVE-2015-20105 · WordPress plugins & themes · reported by WPScanCritical 9.6
The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues
- Product
- ClickBank Affiliate Ads
- Affected
- up to 1.20
- What to do
- Affects up to 1.20. Update ClickBank Affiliate Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 30, 2021Browser and Operating System Finder versions prior to 1.2: Cross-site request forgery (CSRF)CVE-2021-20851 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.
- Product
- Browser and Operating System Finder versions prior to 1.2
- Fixed in
- 1.2
- What to do
- Update Browser and Operating System Finder versions prior to 1.2 to 1.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.