Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

413 results · page 8 of 9

Jun 22, 2023Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any loCVE-2023-35093 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2023SlideOnline: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0489 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
SlideOnline
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update SlideOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 9, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2023-2414 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.4.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload arbitrary files, and inject malicious JavaScript (before 4.3.2).
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.4.6
Fixed in
4.3.2
What to do
Update Online Booking & Scheduling Calendar for WordPress by vcita to 4.3.2 or newer.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 3, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Cross-Site Request ForgeryCVE-2023-2416 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the vcita_logout_callback function in versions up to, and including, 4.5. This makes it possible for unauthenticated to logout a vctia connected account which would cause a denial of service on the appointment scheduler, via a forged request granted they can trick a site user into performing an action such as clicking on a link.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5
What to do
Affects up to 4.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 3, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2023-2415 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia connected account which would cause a denial of service on the appointment scheduler.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.2.10
What to do
Affects up to 4.2.10. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 3, 2023The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WoCVE-2023-2407 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing nonce validation in the ls_parse_vcita_callback() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 3, 2023The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WorCVE-2023-2406 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 3, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized medication of dataCVE-2023-2299 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugin's settings.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 3, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Stored Cross-Site ScriptingCVE-2023-2298 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in versions up to, and including, 4.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
May 31, 2023A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic.CVE-2015-10108 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic. Affected by this issue is the function displayShortcode of the file inline-gdocs-viewer.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 0.9.6.1 is able to address this issue. The patch is identified as 2a8057df8ca30adc859cecbe5cad21ac28c5b747. It is recommended to upgrade the affected component. VDB-230234 is the identifier assigned to this vulnerability.
Product
meitar Inline Google Spreadsheet Viewer
Affected
up to 0.9.6
What to do
Affects up to 0.9.6. Update meitar Inline Google Spreadsheet Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in TheOnlineHero - Tom Skroza Admin Block Country plugin <= 7.1.4 versions.CVE-2023-24007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in TheOnlineHero - Tom Skroza Admin Block Country plugin <= 7.1.4 versions.
Affected
up to 7.1.4
What to do
Affects up to 7.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in SecondLineThemes Auto YouTube Importer plugin <= 1.0.3 versions.CVE-2023-23797 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SecondLineThemes Auto YouTube Importer plugin <= 1.0.3 versions.
Fixed in
1.0.4
What to do
Update the plugin to 1.0.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in PingOnline Dyslexiefont Free plugin <= 1.0.0 versions.CVE-2023-32589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PingOnline Dyslexiefont Free plugin <= 1.0.0 versions.
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2023Avirato hotels online booking engine: Does not validate and escape some of its shortcode attributes before using them in SQL statement/sCVE-2023-0768 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
Product
Avirato hotels online booking engine
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update Avirato hotels online booking engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 29, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin CVE-2022-38077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions.CVE-2023-22681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 30, 2023Bold Timeline Lite: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4828 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Bold Timeline Lite
Fixed in
1.1.5
What to do
Update Bold Timeline Lite to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Build App Online: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-3241 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Build App Online
Fixed in
1.0.19
What to do
Update Build App Online to 1.0.19 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3858 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin.
Product
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button
Fixed in
3.0.3
What to do
Update Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button to 3.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.CVE-2022-37328 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 19, 2022Site Offline Or Coming Soon Or Maintenance Mode: Prevents users from accessing a website but does not do so if the URL contained certain keywordsCVE-2022-1580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
Product
Site Offline Or Coming Soon Or Maintenance Mode
Fixed in
1.5.3
What to do
Update Site Offline Or Coming Soon Or Maintenance Mode to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2022The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0.CVE-2022-2941 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected
up to 2.88.0
What to do
Affects up to 2.88.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Sep 6, 2022WP-UserOnline: Stored Cross-Site ScriptingCVE-2022-2473 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in versions up to, and including, 2.87.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative capabilities and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The only affects multi-site installations and installations where unfiltered_html is disabled.
Product
WP-UserOnline
Affected
up to 2.87.6
What to do
Affects up to 2.87.6. Update WP-UserOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Aug 22, 2022Rezgo Online Booking: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2022-1932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file
Product
Rezgo Online Booking
Fixed in
4.1.8
What to do
Update Rezgo Online Booking to 4.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Event Timeline: Does not sanitize and escape Timeline TextCVE-2022-1324 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Event Timeline
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Event Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Site Offline or Coming Soon: Does not have CSRF check in placeCVE-2022-1593 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack
Product
Site Offline or Coming Soon
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Site Offline or Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022Inline Google Maps: Does not have CSRF check in placeCVE-2022-1829 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
Product
Inline Google Maps
Affected
up to 5.11
What to do
Affects up to 5.11. Update Inline Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Loco Translate: Does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panelCVE-2022-0765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
Product
Loco Translate
Fixed in
2.6.1
What to do
Update Loco Translate to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Podcast Importer SecondLine: Does not sanitise and properly escape some imported dataCVE-2022-1023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
Product
Podcast Importer SecondLine
Fixed in
1.3.8
What to do
Update Podcast Importer SecondLine to 1.3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021WordPress Online Booking and Scheduling: Does not escape the Staff Full Name field before outputting it back in a pageCVE-2021-24930 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue
Product
WordPress Online Booking and Scheduling
Fixed in
20.3.1
What to do
Update WordPress Online Booking and Scheduling to 20.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Qwizcards – online quizzes and flashcards: Does not properly sanitize and escape some of its settingsCVE-2021-24706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Qwizcards – online quizzes and flashcards
Fixed in
3.62
What to do
Update Qwizcards – online quizzes and flashcards to 3.62 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 19, 2021WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.CVE-2021-36832 · WordPress plugins & themes · reported by PatchstackMedium 4.8
WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Oct 11, 2021A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX aCVE-2021-39317 · WordPress plugins & themes · reported by WordfenceHigh 8.8
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.
Product
affected products. The complete list of affected products and their versions are below:
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update affected products. The complete list of affected products and their versions are below: to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
Sep 13, 2021Book appointment online: Does not sanitise or escape Service Prices before outputting it in the ListCVE-2021-24614 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Book appointment online
Fixed in
1.39
What to do
Update Book appointment online to 1.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for: Was affected by an IDOR issueCVE-2021-24562 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades
Product
LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for
Fixed in
4.21.2
What to do
Update LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for to 4.21.2 or newer.
Full record and what to do →NVD record make.lifterlms.com wpscan.com
Aug 23, 2021Timeline Calendar: Does not sanitiseCVE-2021-24553 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin
Product
Timeline Calendar
Affected
up to 1.2
What to do
Affects up to 1.2. Update Timeline Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 16, 2021jQuery Tagline Rotator: Reflected Cross-Site ScriptingCVE-2021-34663 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5.
Product
jQuery Tagline Rotator
Affected
up to 0.1.5
What to do
Affects up to 0.1.5. Update jQuery Tagline Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.9.2
What to do
Update Tutor LMS – eLearning and online course solution to 1.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 7, 2021Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter inCVE-2020-24149 · WordPress plugins & themes · reported by MITREHigh 7.5
Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.
Product
Podcast Importer SecondLine (podcast-importer-secondline)
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update Podcast Importer SecondLine (podcast-importer-secondline) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jun 7, 2021WP-CLI is the command-line interface for WordPress.CVE-2021-29504 · WordPress plugins & themes · reported by GitHubCritical 9.1
WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundl
Fixed in
2.5.0
What to do
Update the plugin to 2.5.0 or newer.
Full record and what to do →NVD record github.com github.com
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
Fixed in
4.21.1
What to do
Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · WordPress plugins & themes · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.8.8
What to do
Update Tutor LMS – eLearning and online course solution to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2021The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.CVE-2021-24219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapie
Fixed in
1.4.13.3
What to do
Update the plugin to 1.4.13.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24186 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24185 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Product
tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify coursCVE-2021-24184 · WordPress plugins & themes · reported by WPScanHigh 8.8
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24183 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24182 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24181 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Product
tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Dec 29, 2020The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF.CVE-2020-35773 · WordPress plugins & themes · reported by MITREHigh 8.8
The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF.
Product
site-offline
Fixed in
1.4.4
What to do
Update site-offline to 1.4.4 or newer.
Full record and what to do →NVD record advisory.checkmarx.net developer.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.