Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
390 results · page 7 of 8
Aug 23, 2022Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.CVE-2022-36379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 23, 2022Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.CVE-2022-34868 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 22, 2022Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.CVE-2021-36857 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
- Product
- Website File Changes Monitor
- Fixed in
- 1.8.3
- What to do
- Update Website File Changes Monitor to 1.8.3 or newer.
Jul 28, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.CVE-2022-35882 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 22, 2022Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.CVE-2022-33191 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 17, 2022Download Monitor: Does not ensure that files to be downloaded are inside the blog foldersCVE-2022-2222 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
- Product
- Download Monitor
- Fixed in
- 4.5.91
- What to do
- Update Download Monitor to 4.5.91 or newer.
May 16, 2022ULeak Security & Monitoring: Does not have authorisation and CSRF checksCVE-2022-1557 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings
- Product
- ULeak Security & Monitoring
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update ULeak Security & Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 18, 2022Daily Prayer Time: Does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users)CVE-2022-0785 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
- Product
- Daily Prayer Time
- Fixed in
- 2022.03.01
- What to do
- Update Daily Prayer Time to 2022.03.01 or newer.
Apr 4, 2022Web-Settler Testimonial Slider – Free Testimonials Slider: Authenticated (editor or higher user role) Cross-Site Scripting (XSS)CVE-2021-36851 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color.
- Product
- Web-Settler Testimonial Slider – Free Testimonials Slider
- Affected
- up to 3.5.8.3
- What to do
- Affects up to 3.5.8.3. Update Web-Settler Testimonial Slider – Free Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 4, 2022In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GECVE-2022-1170 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.
- Product
- Noo JobMonster
- Fixed in
- 4.5.2.9
- What to do
- Update Noo JobMonster to 4.5.2.9 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Apr 4, 2022The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess fCVE-2022-1166 · WordPress plugins & themes · reported by WPScanMedium 5.3
The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.
- Fixed in
- 4.6.6.1
- What to do
- Update the plugin to 4.6.6.1 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Mar 28, 2022Sermon Browser: Does not have CSRF checks in placeCVE-2022-0499 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.
- Product
- Sermon Browser
- Affected
- up to 0.45.22
- What to do
- Affects up to 0.45.22. Update Sermon Browser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022CommonsBooking: Does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queriesCVE-2022-0658 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
- Product
- CommonsBooking
- Fixed in
- 2.6.8
- What to do
- Update CommonsBooking to 2.6.8 or newer.
Mar 14, 2022Simple Download Monitor: Allows users with a roleCVE-2021-24692 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector.
- Product
- Simple Download Monitor
- Fixed in
- 3.9.5
- What to do
- Update Simple Download Monitor to 3.9.5 or newer.
Feb 28, 2022Testimonial: Does not sanitise and escape the id parameter before outputting it back in an attributeCVE-2022-23912 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting
- Product
- Testimonial
- Fixed in
- 1.4.7
- What to do
- Update Testimonial to 1.4.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Testimonial: Does not validate and escape the id parameter before using it in a SQL statementCVE-2022-23911 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection
- Product
- Testimonial
- Fixed in
- 1.4.7
- What to do
- Update Testimonial to 1.4.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 28, 2022Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6).CVE-2021-31567 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compatchstack.com
Jan 28, 2022Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameCVE-2021-23174 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 24, 2022Simple Download Monitor: Does not enforce nonce checksCVE-2021-24696 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads
- Product
- Simple Download Monitor
- Fixed in
- 3.9.9
- What to do
- Update Simple Download Monitor to 3.9.9 or newer.
Jan 24, 2022Simple Download Monitor: Could allow users with a roleCVE-2021-24694 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1) "color" or "css_class" argument of sdm_download shortcode, 2) "class" or "placeholder" argument of sdm_search_form shortcode.
- Product
- Simple Download Monitor
- Fixed in
- 3.9.11
- What to do
- Update Simple Download Monitor to 3.9.11 or newer.
Jan 14, 2022Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).CVE-2021-36920 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jan 3, 2022Download Monitor: Does not properly validate and escape the "orderby" GET parameter before using it in a SQL statementCVE-2021-24786 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
- Product
- Download Monitor
- Fixed in
- 4.4.5
- What to do
- Update Download Monitor to 4.4.5 or newer.
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.1.5
- What to do
- Update Modern Events Calendar Lite to 6.1.5 or newer.
Nov 17, 2021Testimonial: Does not escape some testimonial fieldsCVE-2021-24598 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Testimonial
- Fixed in
- 1.6.0
- What to do
- Update Testimonial to 1.6.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 8, 2021Simple Download Monitor: Allows users with a roleCVE-2021-24698 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.
- Product
- Simple Download Monitor
- Fixed in
- 3.9.6
- What to do
- Update Simple Download Monitor to 3.9.6 or newer.
Nov 8, 2021Simple Download Monitor: Does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributesCVE-2021-24697 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Simple Download Monitor
- Fixed in
- 3.9.5
- What to do
- Update Simple Download Monitor to 3.9.5 or newer.
Nov 8, 2021Simple Download Monitor: Saves logs in a predictable locationCVE-2021-24695 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
- Product
- Simple Download Monitor
- Fixed in
- 3.9.6
- What to do
- Update Simple Download Monitor to 3.9.6 or newer.
Nov 8, 2021Simple Download Monitor: Does not escape the "File Thumbnail" post meta before outputting it in some pagesCVE-2021-24693 · WordPress plugins & themes · reported by WPScanCritical 9
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
- Product
- Simple Download Monitor
- Fixed in
- 3.9.5
- What to do
- Update Simple Download Monitor to 3.9.5 or newer.
Nov 1, 2021OptinMonster: Sensitive information disclosure and unauthorized setting updatesCVE-2021-39341 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.
- Product
- OptinMonster
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 20, 2021OptinMonster: Reflected Cross-Site ScriptingCVE-2021-39325 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.6.0.
- Product
- OptinMonster
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Integration of Moneybird for WooCommerce: Reflected Cross-Site ScriptingCVE-2021-38349 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1.
- Product
- Integration of Moneybird for WooCommerce
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Integration of Moneybird for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2021An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, lCVE-2021-24394 · WordPress plugins & themes · reported by WPScanHigh 7.2
An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection
- Product
- Easy Testimonial Manager
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Easy Testimonial Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 2, 2021The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does nCVE-2021-24492 · WordPress plugins & themes · reported by WPScanHigh 8.8
The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
- Product
- Handsome Testimonials & Reviews
- Fixed in
- 2.1.1
- What to do
- Update Handsome Testimonials & Reviews to 2.1.1 or newer.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Jun 14, 2021When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitisedCVE-2021-24341 · WordPress plugins & themes · reported by WPScanHigh 8.8
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
- Product
- Xllentech English Islamic Calendar
- Fixed in
- 2.6.8
- What to do
- Update Xllentech English Islamic Calendar to 2.6.8 or newer.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Apr 5, 2021Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML wiCVE-2021-24156 · WordPress plugins & themes · reported by WPScanMedium 5.4
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation
- Affected
- 3.0.3 to 3.0.3
- What to do
- Affects 3.0.3 to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2021Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabCVE-2021-24136 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL
- Product
- Testimonials Widget
- Fixed in
- 4.0.0
- What to do
- Update Testimonials Widget to 4.0.0 or newer.
Nov 2, 2020WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.CVE-2020-28033 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Oct 21, 2020Simple Download Monitor 3.8.8 and earlier: SQL injectionCVE-2020-5651 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL.
- Product
- Simple Download Monitor 3.8.8 and earlier
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update Simple Download Monitor 3.8.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2020Simple Download Monitor 3.8.8 and earlier: Cross-site scriptingCVE-2020-5650 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Simple Download Monitor 3.8.8 and earlier
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update Simple Download Monitor 3.8.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2020Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php.CVE-2020-26672 · WordPress plugins & themes · reported by MITREMedium 5.4
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database.
- Fixed in
- 3.0.3
- What to do
- Update the plugin to 3.0.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Jun 21, 2020Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-aCVE-2020-14959 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter.
- Product
- Multiple XSS vulnerabilities in the Easy Testimonials
- Fixed in
- 3.6
- What to do
- Update Multiple XSS vulnerabilities in the Easy Testimonials to 3.6 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Jun 2, 2020common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_usCVE-2020-13764 · WordPress plugins & themes · reported by MITREHigh 7.5
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
- Product
- common.php in the Gravity Forms
- Fixed in
- 2.4.9
- What to do
- Update common.php in the Gravity Forms to 2.4.9 or newer.
Full record and what to do →NVD recorddocs.gravityforms.comgithub.com
Feb 25, 2020The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.CVE-2020-9019 · WordPress plugins & themes · reported by MITREMedium 6.1
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
- Affected
- 5.5.3 to 5.5.3
- What to do
- Affects 5.5.3 to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcert.ikiu.ac.iruploadboy.com
Feb 3, 2020Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.CVE-2020-8549 · WordPress plugins & themes · reported by MITREMedium 6.1
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
- Product
- Stored XSS in the Strong Testimonials
- Fixed in
- 2.40.1
- What to do
- Update Stored XSS in the Strong Testimonials to 2.40.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 30, 2020Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web scCVE-2013-4241 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials
- Fixed in
- 2.0.11
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 2, 2020The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.CVE-2019-20204 · WordPress plugins & themes · reported by MITREMedium 5.4
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
- Affected
- up to 1.9.40
- What to do
- Affects up to 1.9.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 26, 2019The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.CVE-2015-9440 · WordPress plugins & themes · reported by MITREMedium 6.5
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
- Product
- monetize
- Affected
- up to 1.03
- What to do
- Affects up to 1.03. Update monetize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 25, 2019The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.CVE-2015-9427 · WordPress plugins & themes · reported by MITREMedium 6.5
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
- Product
- googmonify
- Affected
- up to 0.5.1
- What to do
- Affects up to 0.5.1. Update googmonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 25, 2019The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.CVE-2015-9417 · WordPress plugins & themes · reported by MITREMedium 6.5
The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.
- Product
- testimonial-slider
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update testimonial-slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.