Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
498 results · page 8 of 10
Jun 13, 2022WP-CRM: Does not validate and sanitise fieldsCVE-2022-1202 · WordPress plugins & themes · reported by WPScanHigh 7.8
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
- Product
- WP-CRM
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update WP-CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022FormCraft: Does not sanitise and escape Field LabelsCVE-2022-1647 · WordPress plugins & themes · reported by WPScanMedium 4.8
The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- FormCraft
- Fixed in
- 1.2.6
- What to do
- Update FormCraft to 1.2.6 or newer.
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
Jun 8, 2022WP Born Babies: Does not sanitise and escape some of its fieldsCVE-2022-1506 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WP Born Babies
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Born Babies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Ask me: Does not properly sanitise and escape several of the fields in the Edit Profile pageCVE-2022-1241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues
- Product
- Ask me
- Fixed in
- 6.8.2
- What to do
- Update Ask me to 6.8.2 or newer.
May 30, 2022Birthdays Widget: Does not sanitise and escape some of its fieldsCVE-2022-1643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Birthdays Widget
- Affected
- up to 1.7.18
- What to do
- Affects up to 1.7.18. Update Birthdays Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022WP Subtitle: Adds a subtitle field and provides a shortcode to display it via [wp_subtitle]CVE-2022-1393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle is stored as a custom post meta with the key: "wps_subtitle", which is sanitized upon post save/update, however is not sanitized when updating it directly from the post meta update button (via AJAX) - and this makes the XSS exploitable by authenticated users with a role as low as contributor.
- Product
- WP Subtitle
- Fixed in
- 3.4.1
- What to do
- Update WP Subtitle to 3.4.1 or newer.
May 9, 2022IgniteUp: Does not sanitise and escape some fieldsCVE-2022-0898 · WordPress plugins & themes · reported by WPScanMedium 5.4
The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues
- Product
- IgniteUp
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update IgniteUp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2022Visual Form Builder: Does not sanitise and escape the form's 'Email to' fieldCVE-2022-1046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Visual Form Builder
- Fixed in
- 3.0.7
- What to do
- Update Visual Form Builder to 3.0.7 or newer.
Apr 25, 2022Donations: Does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated usersCVE-2022-0782 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- Donations
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Thank Me Later: Does not sanitise and escape the Message Subject field before outputting it in the Messages listCVE-2022-1063 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Thank Me Later
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Thank Me Later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2022Easy Social Icons: Does not properly escape the image_file fieldCVE-2022-0840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
- Product
- Easy Social Icons
- Fixed in
- 3.2.1
- What to do
- Update Easy Social Icons to 3.2.1 or newer.
Apr 4, 2022Profile Builder: Does not sanitise and escape Form Fields titles and descriptionCVE-2022-0884 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Profile Builder
- Fixed in
- 3.6.8
- What to do
- Update Profile Builder to 3.6.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 31, 2022Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1: Missing authorizationCVE-2022-23183 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
- Product
- Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1
- What to do
- Update Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 to the newest version.
Mar 28, 2022Interactive Medical Drawing of Human Body: Does not sanitise and escape the Link fieldCVE-2022-0388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Interactive Medical Drawing of Human Body
- Fixed in
- 2.6
- What to do
- Update Interactive Medical Drawing of Human Body to 2.6 or newer.
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
- Product
- Contact Form Submissions
- Fixed in
- 1.7.3
- What to do
- Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Patreon: Does not sanitise and escape the field "Custom Patreon Page name"CVE-2021-25026 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Patreon
- Fixed in
- 1.8.2
- What to do
- Update Patreon to 1.8.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Add Subtitle: Does not sanitise or escape the sub-title field (available only with classic editor)CVE-2021-24897 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Add Subtitle
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Add Subtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2022Custom Content Shortcode: Does not escape custom fields before outputting themCVE-2021-24826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)
- Product
- Custom Content Shortcode
- Fixed in
- 4.0.2
- What to do
- Update Custom Content Shortcode to 4.0.2 or newer.
Mar 7, 2022The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, toCVE-2021-24824 · WordPress plugins & themes · reported by WPScanMedium 4.3
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
- Product
- [field] shortcode included with the Custom Content Shortcode
- Fixed in
- 4.0.1
- What to do
- Update [field] shortcode included with the Custom Content Shortcode to 4.0.1 or newer.
Mar 7, 2022WP Event Manager: Does not escape some of its Field Editor settingsCVE-2021-24810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- WP Event Manager
- Fixed in
- 3.1.23
- What to do
- Update WP Event Manager to 3.1.23 or newer.
Feb 28, 2022EditableTable: Does not sanitise and escape any of the Table and Column fieldsCVE-2021-24898 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- EditableTable
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update EditableTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Image Photo Gallery Final Tiles Grid: Does not sanitise and escape the Description fieldCVE-2022-0186 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.5.3
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.5.3 or newer.
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
- Product
- Buffer Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
- Product
- Translation Exchange
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2022Ninja Tables: Does not sanitise and escape some of its table fieldsCVE-2021-24900 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Ninja Tables
- Fixed in
- 4.1.8
- What to do
- Update Ninja Tables to 4.1.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jan 24, 2022Easy Forms for Mailchimp: Does not sanitise and escape the field_name and field_type parameters before outputting them back in attributesCVE-2021-24985 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.6
- What to do
- Update Easy Forms for Mailchimp to 6.8.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Advanced Custom Fields: Extended: Does not validate the order and orderby parameters before using them in a SQL statementCVE-2021-24865 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.8.8.7
- What to do
- Update Advanced Custom Fields: Extended to 0.8.8.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 17, 2022ACF Photo Gallery Field: Does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_editCVE-2021-24909 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- ACF Photo Gallery Field
- Fixed in
- 1.7.5
- What to do
- Update ACF Photo Gallery Field to 1.7.5 or newer.
Jan 3, 2022WP Travel Engine: Does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pagesCVE-2021-24680 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
- Product
- WP Travel Engine
- Fixed in
- 5.3.1
- What to do
- Update WP Travel Engine to 5.3.1 or newer.
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Tickera
- Fixed in
- 3.4.8.3
- What to do
- Update Tickera to 3.4.8.3 or newer.
Dec 13, 2021Get Custom Field Values: Allows users with a roleCVE-2021-24872 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.
- Product
- Get Custom Field Values
- Fixed in
- 4.0
- What to do
- Update Get Custom Field Values to 4.0 or newer.
Dec 13, 2021Get Custom Field Values: Does not escape custom fields before outputting them in the pageCVE-2021-24871 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Get Custom Field Values
- Fixed in
- 4.0.1
- What to do
- Update Get Custom Field Values to 4.0.1 or newer.
Dec 13, 2021Display Post Metadata: Adds a shortcode to print out custom fieldsCVE-2021-24855 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Display Post Metadata
- Fixed in
- 1.5.0
- What to do
- Update Display Post Metadata to 1.5.0 or newer.
Dec 13, 2021Flex Local Fonts: Does not escape the Class Name fieldCVE-2021-24782 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flex Local Fonts
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Flex Local Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Inspirational Quote Rotator: Does not sanitize and escape some of its quote fieldsCVE-2021-24771 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when the unfiltered_html capability is disallowed
- Product
- Inspirational Quote Rotator
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Inspirational Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021moving the field group which may allow a user to move the unauthorized field group: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20867 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
- Product
- moving the field group which may allow a user to move the unauthorized field group
- What to do
- Update moving the field group which may allow a user to move the unauthorized field group to the newest version.
Dec 13, 2021obtaining the user list which may allow a user to obtain the unauthorized information: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20866 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
- Product
- obtaining the user list which may allow a user to obtain the unauthorized information
- What to do
- Update obtaining the user list which may allow a user to obtain the unauthorized information to the newest version.
Dec 13, 2021browsing database which may allow a user to browse unauthorized data: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20865 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
- Product
- browsing database which may allow a user to browse unauthorized data
- What to do
- Update browsing database which may allow a user to browse unauthorized data to the newest version.
Dec 6, 2021WordPress Online Booking and Scheduling: Does not escape the Staff Full Name field before outputting it back in a pageCVE-2021-24930 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue
- Product
- WordPress Online Booking and Scheduling
- Fixed in
- 20.3.1
- What to do
- Update WordPress Online Booking and Scheduling to 20.3.1 or newer.
Dec 6, 2021Import any XML or CSV File to: Does not escape the Import's Title and Unique Identifier fields before outputting them in admin pagesCVE-2021-24714 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.3
- What to do
- Update Import any XML or CSV File to to 3.6.3 or newer.
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.4
- What to do
- Update Ninja Forms Contact Form to 3.6.4 or newer.
Nov 29, 2021Popup Anything: Does not escape the Link Text and Button Text fields of PopupCVE-2021-24883 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Popup Anything
- Fixed in
- 2.0.4
- What to do
- Update Popup Anything to 2.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 29, 2021Shop Page WP: Does not sanitise and escape some of the Product fieldsCVE-2021-24811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Shop Page WP
- Fixed in
- 1.2.8
- What to do
- Update Shop Page WP to 1.2.8 or newer.
Nov 29, 2021WP RSS Aggregator: Does not properly sanitise and escape the URL to Blacklist fieldCVE-2021-24768 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
- Product
- WP RSS Aggregator
- Fixed in
- 4.19.2
- What to do
- Update WP RSS Aggregator to 4.19.2 or newer.
Nov 29, 2021myCred: Does not validate or escape the fields parameter before using it in a SQL statementCVE-2021-24755 · WordPress plugins & themes · reported by WPScanHigh 8.8
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user
- Product
- myCred
- Fixed in
- 2.3
- What to do
- Update myCred to 2.3 or newer.
Nov 29, 2021About Author Box: Does not sanitise and escape the Social Profiles field values before outputting them in attributesCVE-2021-24745 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- About Author Box
- Fixed in
- 1.0.2
- What to do
- Update About Author Box to 1.0.2 or newer.
Nov 23, 2021BetterLinks: Does not sanitise and escape some of imported link fieldsCVE-2021-24812 · WordPress plugins & themes · reported by WPScanMedium 5.4
The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV.
- Product
- BetterLinks
- Fixed in
- 1.2.6
- What to do
- Update BetterLinks to 1.2.6 or newer.
Nov 23, 2021Forminator: Does not sanitize and escape the email field labelCVE-2021-24700 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Forminator
- Fixed in
- 1.15.4
- What to do
- Update Forminator to 1.15.4 or newer.
Nov 17, 2021QR Redirector: Does not sanitise and escape some of the QR Redirect fieldsCVE-2021-24854 · WordPress plugins & themes · reported by WPScanMedium 5.4
The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.
- Product
- QR Redirector
- Fixed in
- 1.6.1
- What to do
- Update QR Redirector to 1.6.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.