Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
540 results · page 7 of 11
Dec 19, 2023WP Photo Album Plus: Authorization Bypass Through User-Controlled KeyCVE-2023-49812 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
- Product
- WP Photo Album Plus
- Affected
- up to 8.5.02.005
- What to do
- Affects up to 8.5.02.005. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 14, 2023Vulnerability in IdeaBox Creations PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a through 2.9.23.CVE-2023-49739 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Vulnerability in IdeaBox Creations PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a through 2.9.23.
- Affected
- up to 2.9.23
- What to do
- Affects up to 2.9.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 13, 2023Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through CVE-2023-39999 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Sep 4, 2023All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1CVE-2023-2813 · WordPress plugins & themes · reported by WPScanMedium 6.1
All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2, BunnyPressLite WordPress theme before 2.1, Cafe Bistro WordPress theme before 1.1.4, College WordPress theme before 1.5.1, Connections Reloaded WordPress theme through 3.1, Counterpoint WordPress theme through 1.8.1, Digitally WordPress theme through 1.0.8, Directory WordPress theme before 3.0.2, Drop WordPress theme before 1.22, Everse WordPress theme before 1.2.4, Fashionable Store WordPress theme through 1.3.4, Fullbase WordPress theme before 1.2.1, Ilex WordPress theme before 1.4.2, Js O3 Lite WordPress theme through 1.5.8.2, Js Paper WordPress theme through 2.5.7, Kata WordPress theme before 1.2.9, Kata App WordPress theme through 1.0.5, Kata Business WordPress theme through 1.0.2, Looki Lite WordPress theme before 1.3.0, moseter WordPress theme through 1.3.1, Nokke WordPress theme before 1.2.4, Nothing Personal WordPress theme through 1.0.7, Offset Writing WordPress theme through 1.2,
- Product
- above Aapna
- Affected
- up to 1.3
- Fixed in
- 1.1.13
- What to do
- Update above Aapna to 1.1.13 or newer.
Jun 23, 2023JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2023-23679 · WordPress plugins & themes · reported by PatchstackMedium 4.6
Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7.
- Product
- JS Help Desk
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 7, 2023The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data.CVE-2021-46889 · WordPress plugins & themes · reported by MITREMedium 6.1
The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.
- Product
- 10Web Photo Gallery
- Affected
- up to 1.5.69
- What to do
- Affects up to 1.5.69. Update 10Web Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 15, 2023Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform SCVE-2023-2009 · WordPress plugins & themes · reported by WPScanMedium 4.8
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pretty Url
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through CVE-2020-36666 · WordPress plugins & themes · reported by WPScanHigh 8.8
The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
- Product
- directory-pro
- Fixed in
- 1.9.5
- What to do
- Update directory-pro to 1.9.5 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Jan 30, 2023AAWP: Can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companiesCVE-2022-4794 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
- Product
- AAWP
- Fixed in
- 3.12.3
- What to do
- Update AAWP to 3.12.3 or newer.
Jan 9, 2023The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contriCVE-2022-4392 · WordPress plugins & themes · reported by WPScanMedium 5.4
The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- iPanorama 360 WordPress Virtual Tour Builder
- Affected
- up to 1.6.29
- What to do
- Affects up to 1.6.29. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 4, 2023WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes CVE-2023-22622 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddeveloper.wordpress.orggithub.com
Nov 29, 2022The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data.CVE-2021-31693 · WordPress plugins & themes · reported by MITREMedium 6.1
The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware information, previously connected to this CVE ID because of a typo, is at CVE-2022-31693.
- Product
- 10Web Photo Gallery
- Affected
- up to 1.5.68
- What to do
- Affects up to 1.5.68. Update 10Web Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 7, 2022Complianz WordPress plugin before 6.3.4, and Complianz Premium: Allow a translators to inject arbitrary SQL through an unsanitized translationCVE-2022-3494 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.
- Product
- Complianz WordPress plugin before 6.3.4, and Complianz Premium
- Fixed in
- 6.3.4
- What to do
- Update Complianz WordPress plugin before 6.3.4, and Complianz Premium to 6.3.4 or newer.
Jul 30, 2022The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature.CVE-2022-33994 · WordPress plugins & themes · reported by MITRELow 3
The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators.
- Product
- Gutenberg
- Affected
- up to 13.7.3
- What to do
- Affects up to 13.7.3. Update Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jitendrapatro.mepatchstack.com
Jun 13, 2022Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.CVE-2022-1788 · WordPress plugins & themes · reported by WPScanMedium 6.5
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including rCVE-2022-1763 · WordPress plugins & themes · reported by WPScanMedium 5.4
Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2022An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example frCVE-2022-0989 · WordPress plugins & themes · reported by WPScanHigh 7.5
An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example from passing malicious domains to hide their trace, by making them pass through the vulnerable domain.
- Product
- NS WooCommerce Watermark
- Affected
- up to 2.11.3
- What to do
- Affects up to 2.11.3. Update NS WooCommerce Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2022In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GECVE-2022-1170 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.
- Product
- Noo JobMonster
- Fixed in
- 4.5.2.9
- What to do
- Update Noo JobMonster to 4.5.2.9 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Apr 4, 2022MapPress Maps for: Allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" functionCVE-2022-0537 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.
- Product
- MapPress Maps for
- Fixed in
- 2.73.13
- What to do
- Update MapPress Maps for to 2.73.13 or newer.
Mar 28, 2022The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected CroCVE-2021-25071 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- WordPress
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX actCVE-2022-0165 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
- Product
- Page Builder KingComposer
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update Page Builder KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leadingCVE-2021-24996 · WordPress plugins & themes · reported by WPScanMedium 6.1
The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting
- Product
- IDPay for Contact Form 7
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update IDPay for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unCVE-2021-24704 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
- Product
- Orange Form
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server CVE-2021-24689 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack
- Product
- Contact Forms - Drag & Drop Contact Form Builder
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Contact Forms - Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before insertinCVE-2021-24403 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
- Product
- Orders functionality in the WordPress Page Contact
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Orders functionality in the WordPress Page Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 20, 2021A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statemeCVE-2021-24396 · WordPress plugins & themes · reported by WPScanHigh 7.2
A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- GSEOR – WordPress SEO
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update GSEOR – WordPress SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
- Product
- WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any securityCVE-2021-24493 · WordPress plugins & themes · reported by WPScanCritical 9.8
The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE
- Product
- Shopp
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Shopp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2021An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, lCVE-2021-24394 · WordPress plugins & themes · reported by WPScanHigh 7.2
An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection
- Product
- Easy Testimonial Manager
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Easy Testimonial Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, CVE-2021-24393 · WordPress plugins & themes · reported by WPScanHigh 7.2
A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- Comment Highlighter
- Affected
- up to 0.13
- What to do
- Affects up to 0.13. Update Comment Highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to aCVE-2021-24392 · WordPress plugins & themes · reported by WPScanHigh 7.2
An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- WordPress Membership SwiftCloud.io
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WordPress Membership SwiftCloud.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leaCVE-2021-24391 · WordPress plugins & themes · reported by WPScanHigh 8.8
An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- Cashtomer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Cashtomer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before insCVE-2021-24390 · WordPress plugins & themes · reported by WPScanHigh 7.2
A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.
- Product
- WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 23, 2021The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted CVE-2021-24556 · WordPress plugins & themes · reported by WPScanMedium 6.1
The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting them back in the Subscriber list (/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings), leading a Stored XSS issue.
- Product
- Email Subscriber
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Email Subscriber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Jun 14, 2021This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server.CVE-2021-24349 · WordPress plugins & themes · reported by WPScanMedium 6.1
This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2021The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or esCVE-2021-24345 · WordPress plugins & themes · reported by WPScanMedium 6.6
The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
- Product
- Sendit WP Newsletter
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Sendit WP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Jun 7, 2021The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped beforeCVE-2021-24337 · WordPress plugins & themes · reported by WPScanHigh 8.8
The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
- Product
- Video Embed
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Video Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
May 17, 2021There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicCVE-2021-24290 · WordPress plugins & themes · reported by WPScanMedium 6.1
There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.
- Product
- Store Locator Plus for
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update Store Locator Plus for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 17, 2021There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta datCVE-2021-24289 · WordPress plugins & themes · reported by WPScanHigh 8.8
There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
- Product
- Store Locator Plus for
- Affected
- up to 5.5.14
- What to do
- Affects up to 5.5.14. Update Store Locator Plus for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticatCVE-2021-24285 · WordPress plugins & themes · reported by WPScanCritical 9.8
The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
- Product
- Car Seller - Auto Classifieds Script
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Car Seller - Auto Classifieds Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · WordPress plugins & themes · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
- Product
- Tutor LMS – eLearning and online course solution
- Fixed in
- 1.8.8
- What to do
- Update Tutor LMS – eLearning and online course solution to 1.8.8 or newer.
Apr 12, 2021The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in pCVE-2021-24224 · WordPress plugins & themes · reported by WPScanHigh 8.8
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
- Product
- Easy Form Builder
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page.CVE-2021-24211 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.
- Product
- WordPress Related Posts
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update WordPress Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2021The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm_cartCVE-2020-29045 · WordPress plugins & themes · reported by MITRECritical 9.8
The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm_cart cookie in load_cart_from_cookie in includes/class-cart-manager.php.
- Product
- food-and-drink-menu
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update food-and-drink-menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordappcheck-ng.comwordpress.org
Mar 3, 2021The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_CVE-2020-29047 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.
- Product
- wp-hotel-booking
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update wp-hotel-booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordappcheck-ng.comwordpress.org
Dec 13, 2020vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control.CVE-2020-35235 · WordPress plugins & themes · reported by MITREHigh 8.8
vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- vendor/elfinder/php/connector.minimal.php in the secure-file-manager
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update vendor/elfinder/php/connector.minimal.php in the secure-file-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Nov 30, 2020The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.CVE-2020-29395 · WordPress plugins & themes · reported by MITREMedium 6.1
The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.
- Product
- EventON
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 4, 2020Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.CVE-2020-22277 · WordPress plugins & themes · reported by MITREHigh 8
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
- Affected
- up to 1.15.5.11
- What to do
- Affects up to 1.15.5.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcert.ikiu.ac.irmega.nz
Oct 7, 2020The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wCVE-2020-26876 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).
- Product
- wp-courses
- Affected
- up to 2.0.27
- What to do
- Affects up to 2.0.27. Update wp-courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 7, 2020The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the EdiCVE-2020-26596 · WordPress plugins & themes · reported by MITREHigh 8.8
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.
- Product
- Dynamic OOO widget for the Elementor Pro
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Dynamic OOO widget for the Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordelementor.comww2.compunet.cl
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.